Node.js is a security apocalypse. Any language where you compose your app from unsecured and untrusted finegrained pieces spread from across the internet is going to be.
Having n versions of something as complicated as the browser + deps, rotting at different rates, will eventually be a security problem.
Distribution to a browser by https is very natural and can be reasonably lean, we run remote webapps all day without effort. Distribution of megabloat with an install paradigm is noticeably old and inferior. Similarly, update process of remotely managed webapps is (usually) invisible, update process for an installed fleet is agony.
Arguably electron is a transitional, incomplete form of something that wants to be exactly like remote webapps, even if the server part is on 127.0.0.1, it is insane not to use the system web browser already there.