We tried the whole plugin thing with NPAPI and ActiveX, and it was a never-ending source of security holes.

This is one of those things that sound nice, but there's a lot of practical caveats, and in reality it would all be pretty complex. Who would provide the "trusted certs"? How do you decide between a "good and safe plugin" and "not so good and unsafe plugin"? How do you update these decoders? etc.

> I can imagine a world where the first time my browser encounters a file of some new format it gives me the option to download a codec to render it

That world existed, in the 90s and early 2000s, and it was called "ActiveX". The codebase= attribute of the <object> element exists for that use case. It sucked, for two major reasons: first of all, it was a reliable way to get malware into user's machines (being "signed with a trusted cert" doesn't help when all you need for a trusted cert is money and/or hacking a trusted software publisher). Second, it was very Windows-specific, and a significant obstacle to the adoption of alternative operating systems, hardware architectures, and browsers.

I don't think it was the idea behind ActiveX that made it suck, it was the implementation. Back when we were making Windows XP I found a ton of exploits where you could load an arbitrary COM component from a web page and buffer overrun it. If the same thing was based on modern sandboxed IL it would be a lot safer and more portable between platforms.

Activex did way more than render things.