You’re grossly underestimating how difficult it is to pull off these exploits in practice. Even before getting to post compromise activity the adversary has to have a JavaScript VM escape, and also escape the browser sandbox. That shit is worth serious cash and nobody is gonna be spamming the internet with their precious zero days.
Even then you have to perform privilege escalation and map out the network. By this point you’re already pwned. The adversary isn’t gonna be looking for or even capable of pulling off a low level cpu exploit.
if you are especially unlucky the atack comes with you opening a website or similar
and honestly firewalls often only help against atacks against services with open ports running on your system, once they are in your system they have a lot of ways to circumvent your firewall (assuming it's a desktop system or similar, mainly not a single service system)