The modularization was a security nightmare. These plugins needed elevated privileges, a d they all needed to handle security themselves, and as I hope you are aware, Flash was atrocious with security.

Those - yes. But generally something running on a page receiving keystrokes when selected and drawing in a square and interpreting something can be done securely.

And modern browsers have done a pretty good job securing the javascript sandbox.

One can have such a sandbox for some generic bytecode separated from everything else on the page. Would be “socially” same as then, technically better.