I've recently done some research in this direction and was kind of startled that there appears to be practically no interest in how to secure (for example "cryptomessenger"ish) SPAs. There are some things that can be done to compartementalize things a bit (eg. web workers), in the hope that it might mitigate next days' browser bugs, but at the end of the day everyone seems to put a huge amount of trust into a runtime environment of startling and ever increasing complexity and thus a security track record that's mediocre across all vendors at best.

Further adding to it are untethered, unchecked extensions in eg. Firefox. Every extension in Firefox is essentially running with full "browser root" privileges. Chrome at least has a privilege system that tries to avoid allowing every extension to attach a debugger to anything.

(I was also surprised that "how do i run that untrusted JS in my JS context 'safely'?" is a question asked and answered many times)