I get the skepticism — browsers are massive, and the security surface has absolutely grown. But I’d still argue “properly” in the sense that we now have standardized, vendor-neutral APIs, permission prompts, sandboxing, CSP, and the ability to hard-disable features.

Applets gave you opaque binaries with full system access by default; the web at least gives you mechanisms to audit, limit, and turn off capabilities.

And yes, a lot of the modern API surface exists because ad-tech pushed the envelope — no disagreement there. But the same standardization that helped them also enabled PWAs, WASM, privacy-preserving modes, and tools like TeaVM.

So maybe not “properly” as in “perfect,” but “properly” as in “the ecosystem finally has levers for users and developers that plugins never offered.”