computer security is generally broken, and will always be. Code will always have bugs, some of them will be security bugs. Always.
Maybe we should have a dozen protocols for different kinds of applications. (I mean user-facing applications!) Maybe online banking shouldn't involve CSS and JavaScript. Spending some time with Gemini is a real eye opener in this respect.