> A website might serve a different code every time you use it. It might even serve a malicious code specifically for some users. Desktop apps can do this litt

> A website might serve a different code every time you use it. It might even serve a malicious code specifically for some users. Desktop apps can do this little trick, too. Also, many desktop apps can enlist the help of other desktop apps using the three decades or so of various ways our OSes have made to lett apps talk to each other. Bad actors were using macro languages in desktop apps long before the invention of the web browser. Now, it's just as easy for a desktop app to hit an endpoint, grab a script (shell or macro language) and then execute it. The browser is just another desktop app - one with much more scrutiny than that MP3 tagging thing with a built in Lua interpreter that Bob in sales just gave local admin privileges to... Oh, and most desktop apps have some level of access to your identity - or outright have you confirm your identity when you activate your license.