Earlier quoted context omitted.
Doesn't that make it double-bad? Again, people might come up with the argument that it's their own problem if they get abused, but also that is just not the reality we live in; any compromised system can (and will most of the time) be used to infect/compromise/attack other systems.
Good luck trying to a attack an HTML only browser under a Z80 machine, for example.
And if you don't want to exploit the browser or the hardware, you can still simply inject a self-refreshing iframe in to the plain text html stream and have that z80 act like a (slow) proxy so you can do things that will point to that Z80 being the 'origin'.
Everybody assumes that 'simpler' or 'reduced' systems are always safer, but as soon as you deal with external interfaces and the outside world, that goes out the window. Lynx was thought to have less of an attack surface because it just did basic text-based browsing with HTML and not much else. Turns out that wasn't the case either.