How can you build applications on the web that use
Bluetooth or USB devices without these APIs?
Same way you use mice, keyboards, sound cards, printers, webcams and so on: a generic, secure interface supported by all device makers, OSes and browsers.The whole benefit of web apps is they demand less trust because they're better sandboxed. Poking holes in the sandbox (like WebUSB) makes web apps worse, not better.
a) Don't do it and pivot your company to doing something else.
b) Implement your own solution with companion native apps that build this missing bridge. Out of public scrutiny and with many times less resources, but hey: the browser is secure! ;)
Really? Web applications can essentially change at the whim of the owner or server(s) hosting them, every time you refresh the page. You have far more control and "transparency" over when a native application changes.
Is it even using tls for network requests? So many things we can’t see in a native app.
You're just not looking hard enough. ;-)
As all the vulnerabilities discovered and exploited in closed-source software shows, along with those in open-source which have been there for many years without being discovered, whether the source is open or closed is nearly irrelevant.
To quote the mentality of those who see beyond that debate, "Source code? We don't need no stinkin' source code!"
Unfortunately, the only viable alternative right now is to install a companion native application. That companion app launches an (https/ws) server that talks to the device and exposes some api for your site to use through javascript.
It is a disgusting can of worms, but if you squash them all you get a working system at the end.
You simply don't
Also, maybe bluetooth and USB devices don't need to be on the net.
Only if you believe minified JS is significantly easier to audit, which seems rather unlikely.
In both cases, the thing which works is securing the capability rather than the code. Having generic USB support is risky but e.g. having mediated access to cameras and microphones has been fine.
I find it highly unlikely we are going to be able to trust "mediated" access.