[gildas]

I agree with you. On the other hand, in the case of a native application, we can hope that the antivirus removes it. I hope that Microsoft has planned to update Defender accordingly.

[postalrat]

Unlike the native app you probably won't have to worry about web page encrypted your files and asking a ransom.

[bentcorner]

For now

[int_19h]

JavaScript malware has been a thing for a while now, and antiviruses have been targeting it accordingly.

[gildas]

It's not necessarily a JavaScript malware. A pure HTML page with a <form> tag could suffice to steal credentials.