Don't forget sandboxing. Browsers routinely execute unsafe scripts (hopefully) without compromising the user's account or event the browsing session. OSes are still far behind.

I always say that this situation is a bad solution to a bad problem. Had Apple, Microsoft and the FOSS world agreed on some standards, native code could be portable and the norm.