The biggest blunder was not adding UTF-8 strings as a first class citizen

The second blunder was not allowing for any direct memory mapping I know it's against the security system but if you have to copy every pixel one by one to the host then that won't be effective

The third blunder was when they finally added GC objects to not make any of the objects properties readable from the host