That's half the reason. The other half of the reason is that Web applications are way easier to deploy, even if 100% of your users are on Windows, because the

That's half the reason. The other half of the reason is that Web applications are way easier to deploy, even if 100% of your users are on Windows, because the second-order-effect of being locked-down is less gatekeeping and less scare screens. If a web app is able to see stuff that it hasn't been explicitly granted access to, that's considered the Browser's fault for allowing it instead of it being the User's fault for installing an untrusted app.