This is what it really comes down to. Browsers are built around origins as the major security boundary. When you use a separate origin, safety comes for free.