Yea even web.telegram.org just uses localstorage directly. I think the basic is if the user's browser is already compromised, the device's user is mostly compromised, too, already