If Vulkan doesn't have enough security features to support the web, you'd think Apple would work with Khronos to get them implemented, instead of rolling their own API.

It's yet more 'not invented here syndrome' from Apple.