Right, but browsers are "regulated". The attack surface that a website has against a user is much smaller than what an app has. Or at least was, I think website

Right, but browsers are "regulated". The attack surface that a website has against a user is much smaller than what an app has. Or at least was, I think websites and apps are converging now.