I agree, and it seems like the incumbents in this user-oriented space (OS vendors) would be letting the messy, insecure version play out before making an earnest attempt at rolling it into their products.

It always depends on who you consider the user. The one who initiated the agent, or the one who interacts with it? Is the latter a user or a victim?