PBKDF2 is an standard that is readily available in all the frameworks being used for this product. This is important because all products must be doing crypto the exact same way and this can be a bit of a challenge to keep in sync without a standard. I am also attempting to keep my third-party library exposure to a minimum when it comes to crypto functions. I realize that PBKDF2 is a pretty old function, however, I am not aware of any risks in using it as long as iteration levels are properly increased over time.
AES256-CBC is used because it provides the level of crypto that is needed for this type of application. I realize that CBC lacks the integrity checks that other methods may offer, however, I am not sure integrity is needed to still provide a secure exchange of ciphers from a trusted source as is being done here.
Crypto is only done in Javascript for the the website and browser extensions. Maybe I am not understanding your question here fully, but I am not sure of any other way to handle Crypto on the client side for these environments. For the mobile products, crypto is being done using local CommonCrypto (iOS), BouncyCastle (Android), and .NET.
I hope this answers your questions and thanks again for having a look!