I don't think artifact binding really addresses many of the issues people are talking about when they suggest OIDC is categorically more secure than SAML.
Browser sends artifact to RP, RP fetches assertion from IdP via HTTPs, afterwards verifies the signature.
Signature verification is not implemented correctly? The attacker still needs to break HTTPS…. And then you would have a big problem anyway.