So Lua alone is not sufficient: the pseudo threads created by coroutine.create have unlimited time resource if they never yield (because the routines are not preempted at all by any scheduler enforcing the time quota) and they also have unlimited access to the same allocator (there's no equivalent to the Luac function lua_setallocator, and in fact no way to create such allocator in Lua, but we could still have the way to have a __alloc metamethod in thread object types that would be used to measure the memory resources requested by the thread in order to limit them by just returning a Boolean authorizing or not the use of the global allocator
The Lua team designed an extension language that's powerful and small, and you want it to be something else, a multithreaded language with advanced scheduling and fine control over memory allocation, and because it's not you complain it's lacking in that respect. That's like buying a small roadster car and then complaining you can't haul building materials with it.
The coroutines in Lua solve a very useful problem: you can code event-driven programs without having to resort to the callback hell you see in Node.js. It's not meant to be used for single programs that can keep a 48 core server busy, although you can run multiple Lua states and figure out a way to make them communicate (Lanes etc.)