Platform independent code would be no more insecure than the current scenario. In fact I'll claim that it would be more secure due to reduced attack surface area.
This HTML/JS/CSS scenario evolved. It wasn't designed. If you started with a clean slate and designed the front-end, would you have something completely different.
I'll make another claim that I'd be interested in hearing feedback from others. If IBM had allowed CMU to make the Andrew Window Manager FOSS in '88, we never would have gone down the HTML rabbit hole.