- It had to be an app because the web NFC API[0] only allows a browser to act as an NFC reader rather than emulate an NFC card. Nothing stopping other functionality outside of the tap-to-connect working in a browser of course.
- Permissions to act as an NFC card were fairly easy to set up on Android, but needed specific developer permissions for Apple[1], which had to be applied for[2][3].
Worth also noting that other proximity techniques such as QR scanning and geolocation are much more easily spoofed than NFC, making them much less useful as a proof-of-human validation.
[0] https://w3c-cg.github.io/web-nfc/
[1] https://developer.apple.com/documentation/corenfc/cardsessio...
[2] https://developer.apple.com/support/nfc-se-platform/
[3] https://developer.apple.com/support/hce-transactions-in-apps...