The issue is that with LLMs it's fundamentally impossible to have a "prepared statement" (the database query concept), whereas a web browser has no problem in principle being a safe sandbox. With LLMs, we have no idea how to make them safe even in principle. This has nothing to do with "security is hard" hand-waving.