Agreed, which is why we need to severely limit what the servers can do with the clients. The security and usability fallout from this is going to be terrible, and it pains me to see the internet I love head this direction just to make a couple bucks.
But it seems unlikely things will go that way. People are motivated by what they can make webapps do, and will take the quickest way to get there. Doing it right, where the end user has the most control, is more work to design and implement, so people won't bother.