There is a third big advantage to web apps over native apps - they're run in a hardened sandbox designed to safely execute untrusted code.
Almost every website now requires JavaScript for the most basic functionality and the regular browser user isn't going to bother with installing an extension and enabling each piece of JavaScript manually to ensure that it is safe. I personally don't believe the JavaScript approach is even maintainable anymore. These Web APIs are so complex that you need third-party frameworks to make them useable and before you know it your site relies on 30+ frameworks for functionality that should be included by default in a markup language.
The browser sandboxing model has a huge attack surface, as proven by the hundred vulnerabilities found.
I don't see Firejail wrapping all of the apps coming from the AppStore any time soon.
In contrast, native app firewalls are only starting to get developed and are far less battle-tested than the browser sandbox. Heck, just look at one of the other threads on the current HN front-page for how weak native app firewalls can be: https://news.ycombinator.com/item?id=23689364
Not even speaking about bugs, guess what will this cause in combination with users conditioned to blindly click OK on security warnings:
https://www.fixyourbrowser.com/browser/google-chrome/google-...
You might want to re-evaluate your threat model there.
Note that all these problems apply to Firefox, Safari and Blink as well.
And most (all?) of them apply to other platforms (cite: TikTok, plenty of viruses on every platform).