It's partly, or even mostly, a problem of trust. Back in the wild days of the internet you just couldn't trust a website to have a lot of control over your computer. You could argue that this is no longer the case since we're slowly building up the 'web of trust', but I think we're not quite there yet. Since there used to be less facilities to write speedy online software (secure offline storage, closer-to-the-metal 3D APIs) people were stuck with the old HTML+Javascript and never really evolved out of it. It's not the right way to go, but it's a necessary step to develop the infrastructure that'll be necessary for the next big leap.