I'm sorry, but the likeliness of zero days in a c++ program that was too stupid to handle char arrays or multithreading is way off the charts vs heap spraying bugs in a VM.
I'd argue that native applications therefore are far more vulnerable than web applications.
Desktop applications can track your every click with HTTP requests to their server.
The runtime does not determine this.
And if by offline you mean PWAs, unless you are doing Hello World, that app cache is going to be cleared and then analytics can be updated.
Finally, there is very little a pure PWA can do without doing HTTP and Websocket requests.
Desktop code cannot be verified. Web code can be verified. This argument goes both ways.
If we're talking about the web-equivalent of Desktop Apps: There's electron, which can do far more than HTTP requests and WebSockets - but that on the other hand is also too bloated, right?
Sometimes I wish people would just make up their mind, stop complaining, and start trying to fix it. We had servo, and we had a nice modular and privacy respecting future for everybody; and then we messed it up because apparently nobody really cares about it.
Please explain the crowd how you verify the SaaS server side.
Electron is an abortion, that will eventually follow Active Desktop footsteps after its fashion hype curve dies out.
In any case, Electron based apps can do whatever user account they run under.
HTTP is simply the delivery mechanism for a self-contained WASM application. Just like it is the delivery mechanism for most native binaries now.
If it's in your browser, you can see the code it's running and the data it is transmitting. And you're only a single uBlock Origin (other other browser add-on) filter away from blocking it.
My gentoo install would like to have a word with you