Unpopular opinion... but I think this is a too limited view of the web. My contrary opinion is that the actually important feature of the web is the URL, and the important feature of the browser is that it provides a sandboxed platform for running untrusted code without a builtin "walled garden moral police". It would be nice if operating systems would be exactly that, but for some reason "commercial" OS vendors are…
That view of the browser is what I want to have. It blows my mind that we still have to tell people “don’t click links in your email” because it’s still possible for something terrible to happen if they do.
There are very few RCEs now on modern browser (they still exist[0,1], though). The main threat is phishing, because users are gullible (and should be educated).
[0] https://www.mozilla.org/en-US/security/advisories/mfsa2019-1...