You can't know how many times your browser's let malware through, there's practically no supply chain security, no reproducible builds, no way to know what code has been executed.

I don't need anyone's approval to run native apps either, both my PCs run C apps I built from source and shell scripts I wrote myself without it, languages of my choice with implementations simple enough to write myself, not runtimes that literally no one that's not Google can afford to independently maintain. That's real openness.