I think you're dramatically underestimating the importance that advertising and bundling had in the rise of Chrome. Every non-techie I've talked to about this basically uses Chrome because Google told them it was the best, and Google is the first internet page they go to whenever they go to the internet.
IIRC some Firefox devs also accused them of tweaking sites like Youtube in particular ways that only affected competing browsers and made performance worse comparatively.
We've seen Microsoft throw money and bundling with IE and Edge, and it still hasn't done much. Even with being able to bundle Edge as the OS default - the biggest advantage anyone could ask for.
Then Microsoft bundled IE4, and killed Netscape (it took a while, but the unstoppable momentum was built with bundling/embedding).
Chrome is “bundled” with Google. Every Google search recommends it, and everyone uses Google. Same for YouTube which to this day works better and faster on Chrome. Android (80% user base at the time it happened) also pushed Chrome.
Chrome wouldn’t have become popular if it wasn’t good. But the market dominance did not come from being good - it was just a necessary condition for market dominance in a market already dominated by incumbents.
Maybe not widespread attacks, but the Chrome team regularly see 0days being actively exploited in the wild, I imagine as rare and isolated incidents instead of mass pwning billions of users. For some exploits to work you have to visit a carefully crafted page that has the payload in it. And that's not easy to do at scale. You'd have to cajole millions (billions?) of people into navigating to a specific URL. Also I imagine you don't hear about these exploits because the actors would have good op-sec and keep all their data gathering secret.
Chromium isn't successful because of the billions thrown at it. It's successful because it was significantly better than anything else during its rise:
It was significantly faster than IE and FF. Much better memory management and crash handling via separate processes. Strict adherence to web standards. Seamless auto-updates that required no user intervention - ever. No admin privileges needed for updates. Clean UI that stays out of your way. Top-tier developer tools built-in. Very secure. Has there ever been a widespread instance where users were infected with malware from a Chrome exploit? I haven't heard of one yet.
Any competitor to Chromium needs to be significantly better than it for genuine reasons. Unfortunately, "not Google" and "privacy" aren't going to cut it for most average users to switch over. Unlike Meta, Google's reputation isn't in the trash so people still trust them.