> might become necessary to wrap browsers in an isolating sandbox or VM just to be sure they can't touch things they're not supposed to.

Honestly I view this as a good idea regardless (it also helps contain exploits, in addition to official APIs). On Linux firejail is amazing for this (but also consider bubblewrap and others), and AFAIK sandboxie is a good choice on NT. No idea what sandboxing options are on Darwin - looks like it has something built in?