When it’s in a browser you don’t need to install anything on the local machine. I used to use Apache guacamole to access my machine at home from work when I was stuck in a cube all day.
If you have factual observations to make that's fine but can we stop with the "smells like vibe coding" attacks? It's like an AI version of an ad-hominem attack.
Browsers are sandboxes, your native client often isn't, there is definitely a huge advantage, portability and embeddability as well, it's also simpler to sniff traffic (and MITM it).
Having just implemented OAUTH into a Go app this week, I can assure you that it’s surprising easy to do so without making your entire application a website.
https://guacamole.apache.org/