Stated "Should local desktop control API be widely available to web apps and be commonly used?", the answer is surely no.

"Should local desktop control be a feature that can be enabled through web browsers for users who choose to use it with certain sites?" Eh, this is not so clear. What if by some magical turn of events Zoom decided on a drunken whim that user privacy is very important, and strongly encouraged use of web over desktop, should they just axe that feature? Back in reality, Zoom couldn't even consider that course of action until the web supports it.

Maybe do it by requiring users to install an extension that's granted remote desktop permission for a particular site. Which would at least allow the extension to be reviewed and audited.

Chrome Remote Desktop does it (requires a browser extension though I think).

And the browser extension runs a native .exe file behind the scenes...