I feel like the honeypots created by canisters are much larger than you would find by breaking out of the Wasm sandbox in most web apps (the web app is just the frontend, not the actual server where a bank account is managed). And each application (tab) in the browser has a Wasm sandbox, and that sandbox is also sandboxed within its own process. We’re pointing out that the IC does not meet the standard of the browser. If all of your tabs and domains shared the same process, that would be more equivalent.
It’s also only been a few months since the value inside of canisters started accruing, so not much time to feel too comfortable.
I think it comes down to this: there is an obvious vulnerability with an obvious solution, and we should make implementing that solution a priority.