Your quoted part seems to refer to people using the OS browser component in some contexts (eg app embedded web content) and the actual browser app in others. It

Your quoted part seems to refer to people using the OS browser component in some contexts (eg app embedded web content) and the actual browser app in others. It's good to be aware of but claiming the resulting attack surface is the union is only technically correct. The resulting risk is not increased correspondingly as you are not accessing most content through 2 browsers.