I believe webGL "cryptojacking" as it's called, indeed is a thing. Not sure on prevalence though or to what extent this introduction makes it more viable for malicious actors.

I'm not sure if lots of hashing algos are gpu-ready or optimized either.