Let's take Lemmy UIs as an example. In a world where this "RCE" is removed, all API calls and returned data would have to go through a "server client" first. I hope this won't take you long to ponder if that's an improvement or not 😉

The web is indeed shit. But dumber web means more "clouding", or if it's not "clouding", and to borrow from your reductionist fatalism: Dumber web replaces a potential RCE with a definite MITM.