First, you're equating ARM and x86 with Microsoft Windows. Those are all "platforms", but they exist at very different levels of the technology stack, and the impact of relying on them is quite different.
Samsung and Apple can both ship compatible ARM devices. Only Microsoft could ship an ActiveX runtime.
Second, you're throwing out "security" as a red herring without actually explaining what is insecure. Exactly what are you talking about?
Lastly, if PNaCL is not viable, then NaCL is not viable. Thus, Google is holding off on NaCL until PNaCL is viable. In the meantime, I'm targeting mobile and desktop applications -- today -- which is entirely consistent with my earlier stated position.