> which have to load and run untrusted, unverified data and code within critical system libraries (many of which with kernel-mode access, such as GPU drivers, sound drivers, USB subsystems, and more),

No, they don't have to. The fact that someone decided that a browser shall run remote code (JS) is sad.