[skybrian]

I don't know what they meant, but in principle, I don't see why WebAssembly apps can't be downloaded, since browsers do it? (Ideally they should be signed, but using a more distributed scheme, like DNS.)

Due to phishing, it seems like most people do need security software, but not necessarily provided by the OS vendor. It could be from a plugin.

The biggest issues are lack of resources and lack of standardization. What organizations have the people to do all these things, besides the OS vendors?