If a browser's sandbox can't even protect against accidental resource exhaustion, I'd be very concerned about that as an intentional attack vector.
Memory can indeed be a problem, but at least if a tab becomes the largest single memory user on my system, the OOM killer will come for it first.
So if for CPU and memory browsers can lean on the OS for proper resource management but it’s not the case for GPU, maybe their WebGPU implementations aren’t ready for production yet.
This is a problem with popular Linux distributions, they do not have protection against application swapping out important system applications.
Linux has disk quotas and CPU scheduler but it doesn't have fair memory and swap management (or this is not configured out of the box). For example, desktop shell doesn't have protection against being swapped out.
A per-process real memory maximum that automatically invokes the OOM killer unless somehow opted out would probably be useful.