but the converse is also true: if they don't implement EME, then you are welcome to install any third-party attack surface on your PC that you wish.

so why should _I_ have to install the un-auditable attack vector on _my_ machine?

you are well-positioned to understand this issue, so I'm baffled about how you can conclude this should be part of the default software suite in a browser.