Right, and the only solution is to audit and compile all the code running on your computer, including firmware. Otherwise, you have no idea what your computer is really running.

In the real world, most people run pre-built software, which is worse than this ideal. I agree that browser Javascript is worse still, but it's still better than sending secrets to a centralized server somewhere.

Security is a spectrum, not a binary on/off thing like this article tries to paint it. Things can still be helpful, even if they aren't perfect.