tank on Nostr: I want to like PWAs. But what‘s the strategy to mitigate attack vectors like web ...

I want to like PWAs. But what‘s the strategy to mitigate attack vectors like web server compromise and XSS? It seems like only a matter of time until honey pots are attractive enough, especially for lightning wallets. I‘m not sure the UX trade-offs of using browser extensions are workable as every signature/transaction would have to be confirmed within the context of the extension UI.