For me it’s not only privacy, I just don’t trust an agent to use my credentials without doing any destructive task because unlike an MCP, I cannot enforce any permission model on the browser