What makes you think web apps can't enable exploits that compromise your system? Anything that can run code on your machine enables attacks. Even Javascript that gets run in browsers have enabled attacks on the local system.
If anything web apps decrease your security since a binary can be vetted and verified as unchanged, but when you open a web app you're at the mercy of whatever it is and does in that moment.
web apps also have access to the file system, although there are extra steps
https://developer.mozilla.org/en-US/docs/Web/API/File_System...
Here's a shell! https://rreverser.com/webassembly-shell-with-a-real-filesyst...
Webassembly is overwhelmingly used for malware (https://www.crowdstrike.com/blog/ecriminals-increasingly-use...) but at least it's usually just mining cryptocurrency. I'd guess it's only a matter of time before it's commonly used for much worse.