I agree with the premise though its easy to validate if these tools are sending data to a remote dest with the network activity developer tool in any of the major browsers.
Sure, but to be sure you’d have to validate it every time, because the site’s content may have changed since your last visit. Do you?
No, you'd just have to validate it when you're inputting something particularly sensitive (and I really do usually look in the network console when I'm doing something like that)
The network console isnt going to tell you if the site's exfiltrating data via websocket or webrtc.
It actually will (at least for websockets), it's just that websocket messages aren't nicely included in the timeline along with typical requests. You need to find the request that initiated the websocket and go to the details -- it shows the messages there
Presumably you enter dummy data to validate first. What if it doesn’t send that, but does send the real data?
Then I'd change the keys in that rare circumstance. What are the chances the attacker will be able to take advantage of the leak before I have a chance to change them, particularly given an attack like this would likely be a blanket attack and not targeted?
Sounds like a lot more work than using a local solution.
Personally I don't feel that's true if you include the significantly increased amount of research necessary to even find a decent local solution most of the time. Web apps are much more discoverable.