Securing the data in transit and securing it on a device are two different concerns and it seems silly to expect a network protocol to be able to secure against

Securing the data in transit and securing it on a device are two different concerns and it seems silly to expect a network protocol to be able to secure against scenarios where malware is at play. If you're infected with malware, just patch Chrome in memory to report everything as SSL connected, etc. If you're already compromised, nothing Google can do can help you.