> because it only requires a single link or URL to download the software and have it run immediately as required
Agreed, but I would argue that the only reason why it's possible to have a single URL to download and run the software is because there's decent sandboxing.
Linux does have some decent security utilities, but it's only recently that they're starting to show up in non-developer contexts for everyday apps (basically Wayland, Flatpak, Bubblewrap, all of which have experienced pushback from the community) -- and while I fully approve of that effort, it's not anywhere close to the level of security yet that the web offers.
I would say that if you would feel comfortable with a native app installation workflow that worked exactly the same as the modern web's app delivery mechanism (ie, you can click on a link and a native app that has never been pre-vetted or moderated is installed and launches on your computer without any confirmation and without taking you to a store page), then... that's halfway decent sandboxing. The first bar to clear is "do I feel comfortable running arbitrary untrusted code that has never been validated by anyone?"
The second couple of followup tests that the web itself struggles with is stuff like "is this spying on me, is this fingerprinting my computer, how easy is it for this thing to phish me?" To me, that would be when we start to move pass halfway decent sandboxing to "good" sandboxing. I'm not sure the web deserves that label.
But I don't know of any native platforms that pass even that first bar where I would feel comfortable running malicious code on the system. I mean, sure, you can set up VMs and Firejail and I could if I wanted to set up a Linux system that had good sandboxing -- but none of that stuff is accessible to your average user; it's security for the very few people who know how to set up that security. Meanwhile, the web is security for every single person with a web browser on every single one of their devices.
Arguably mobile phones have started getting closer, but Apple is still claiming that the reason they can't open up their app store is because it would be insecure, so if we take them at face value they don't believe that their sandboxing is good enough to allow for untrusted code execution. And I'm hoping that eventually the combination of Wayland and Flatpak turns into decent universal sandboxing on Linux for every app the user is running on every distro, but we've still got a long way to go.
> Additionally, HTML + CSS + JS have proven to be the most popular UI platforms
This is certainly part of it, but... people write JS that don't like JS. I don't think it's a good enough explanation on its own.
But just opinion me, I don't have strong opinions about that.