The Nintendo Switch generally only allows white-listed pages. So the attack vector is pretty small.
The other consoles, yes, should be possible. But I think not too many people use their consoles for browsing.
In addition they do have a store with indie games which seems to be more or less open to anyone (I assume there are some checks but I wouldn't trust them completely) much like Steam.