Exploits have existed in web browsers since they were invented. Everything is eventually executed at some point, it really just depends on how good the thing do

Exploits have existed in web browsers since they were invented. Everything is eventually executed at some point, it really just depends on how good the thing doing the decoding/encoding is. Just because something is slow and seemingly encapsulated doesn't mean it is safer than running it lower to the metal. That's almost like security through obscurity, adding layers because you think it's safer, not because you know it is. Sometimes the layers are what make it more vulnerable, not less.