Statistically speaking, more users get owned via web browsers than via native apps, and that is unlikely to change if people keep on adding new APIs to web browsers because every time a new API is added to my web browser, every web site I visit gets a chance to use the new API to try to own me.

I certainly understand why developers and others find it convenient and profitable to keep on adding APIs the client part of the global client-server document-publishing platform, but I am simply amazed to come across someone using security of all things as an argument or a justification for doing it.

Think about what you are saying! You have a new API you want to make available to developers, but of course it is really hard to create an API that cannot be exploited, so to keep things as secure as possible, every time the user needs to check the weather forecast, look at the new photos of the grandkids or look for a new recipe, some random web server plus zero-or-more third-party ad servers should get a crack at exploiting the new API!