But for desktop applications it is bloated, a big attack surface.
HTML/CSS is made for online documents, and using it for applications is a bit hack that happen to work, but hides a huge ton of complexity behind frameworks and frameworks of frameworks with leaky abstractions and each their own caveat.
Wdym? At least web apps are sandboxed by default in contrast to native.