Anti2030 What I don't understand is why tutamail that preaches security and privacy, forces you to activate this function,
According to tuta itself, the webapp has to do Argon2 key derivation and it is a very slow operation without WASM or JIT. This doesn't mean tuta will exploit your browser. So to enhance functionality / user experience as @DeletedUser495 already pointed out.
While in practice JIT and WASM are 'parts' of the browser that get leveraged relatively frequently by malicious actors, it doesn't mean every website that uses it is malicious. Hence why it is disabled by default and user consent has to be given to explicitly enable it for trusted websites.