> assumptions about who is responsible for data security.
The chief assumption appears to be "anyone but the browser vendors". Let us consult the article:
BeEF
This, to me, was the most impactful demo
"...examines exploitability within the context of the one open door: the web browser."
There could hardly be a clearer expression of contempt for the browser vendors' offerings. But remember, the "open door" is nothing to do with them, it's all your fault for not serving via HTTPS.
Welcome to Clown World.