In the browser, PBKDF2 can still make sense, because all modern browsers support it via SubtleCrypto.deriveKey(), and you may want to avoid the overhead of a JS-implemented alternative. Just select the maximum iteration count that is still acceptable for your use case and targeted devices (mobile devices tend to be the slowest).
Very true. May make sense to check how WASM implementations stack up, though. Makes me realise I don't even know if WASM does multithreading; maybe via background workers?
