Secure messaging has to work. All the time. If your threat model is criminals, Gchat will protect you just fine. You use encrypted messaging to prevent governments from reading your messages. Look at the Telegram/Iran fiasco for an example of this.

So: my recommendation is, never use any secure messaging system that boots off a web page. No matter what they claim to do to mitigate the risk.

I'm actually, for a bunch of specific reasons, not super comfortable with browser extension applications either. But at least the browser tries to protect an extension you have to explicitly install and explicitly run.