If Mighty behaves like a full replacement for a modern web browser on my system, it will have to give the web pages I visit (opt-in) access to my GPS, camera, microphone, Bluetooth, battery information, and other peripherals, I sliding all of my mouse and keyboard input. It will have to allow me to upload or download files from the web page. Also, all my tabs are running on the same remote VM, so this only protects other systems, not my banking or JIRA.

Sure, it's the ultimate sandbox for the code itself, it probably protects me perfectly from Meltdown attacks against other programs on my main system, but I don't think that's enough to call it 'endpoint security'.