Being able to visit a web page, open a PDF or download and inspect a git repo without the web page, PDF or git repo's being able to completely pwn the entire machine including the bootloader and the firmware for all the hardware subsystems.

Desktop Linux is very bad at that compared to ChromeOS and MacOS, but some distros are much better than others. For a few decades now, Fedora has been one of the better ones.