Javascript was designed to be secure-by-default, and it takes a vast amount of effort to keep it that way

Native apps were designed to be powerful-by-default, and the amount of effort to bolt security on after the fact is orders of magnitude more