> You'd think that client side security would be something that we'd gotten over by now.

Well, we have passkeys. /s