You say that like the web hasn't been. Hell, even if everything always worked properly, there were not XSS attacks, and users weren't easily fooled, the web would still be full of malicious actors in the form of tracking and advertisement.

Remember, we invented pop-up blockers because advertisers abused it, and we've been in an arms race with those assholes ever since. Tracking and ads in desktop apps came from the web ecosystem and now we're stuck with it.

I don’t think you can equate the two. ActiveX was barely sandboxed... in fact I’d like to say they were not sandboxed at all. They were native code running basically as root on your machine.

It was something that came back when Microsoft was still convinced the internet would be a fad. Those activeX things could do all sorts of fun exciting things on your computer.

Oh ActiveX was definitely worse, I should know since I was using the internet plenty when it was prominent. My point is, though, that malicious actors still basically control the web. They may not be executing native code without any controls, but that doesn't mean that the modern web isn't still their playground.

Oh yeah speaking of popups I once made a horrendous bouncing image script for IE 5.5 that allowed images to fly around your screen outside the browser window.

http://dynamicdrive.com/dynamicindex4/bounceimage2.htm