A malicious website would have a hard time capturing (or injecting) info an OS terminal running on an entirely different process than it would on a browser with imperfect context separation.

You clearly misunderstood the issue.