Most applications don't have anywhere near the huge Web-facing attack surface that the browser has, and have to do a lot more communication with the host OS tha

Most applications don't have anywhere near the huge Web-facing attack surface that the browser has, and have to do a lot more communication with the host OS than the browser does, so the tradeoff is less worth it. However, I think something like this will be slowly making its way to more applications as time goes on. The browser is just the most obvious first test subject. I'm not really worried about it being used as a crutch. ASLR and stack canaries didn't stop people from fixing application bugs, because people know that no mitigation technique is perfect, and they're supposed to be a last resort if the application fails.