It can't do whatever it wants. It can make responses for requests that would go to that particular website without actually making the request, that's it - that is, the website can provide some code that makes local responses on its behalf for things it could respond to anyway. It can't intercept (or even see) anything for other sites. That's a significant difference from installing executable code in the form of a standalone binary.

I do agree, more broadly, that there's a place in this world for a s web-like thing that only lets sites provide text and minimal formatting and doesn't let them run any code at all, even in a constrained/sandboxed environment. (https://gemini.circumlunar.space/ seems like the most promising thing in this space.) But the web hasn't been that since 1995 when they released LiveScript.