Point 2 is very problematic though, you can write a browser extension that compares the checksum of app.js, but if it changes and it is just minified obfuscated

Point 2 is very problematic though, you can write a browser extension that compares the checksum of app.js, but if it changes and it is just minified obfuscated code, how will you know it's safe to execute. You don't. Same applies of course to chat apps that offer end to end encryption. Maybe it's safe for messages to be intercepted, but can you trust the application decrypting messages and displaying to do just that?