What is the practical difference if the OS provides your general-purpose sandboxed runtime instead of the browser? The browser is already a product being developed by the same organization as the OS for a significant chunk of people.
iOS -> Safari
Android -> Chrome
Windows -> Edge (based on Chromium, so fixes in Edge make their way into Chrome too)
The sandboxed application would be something you explicitly chose to run. When the browser is the platform, every web page you visit has access to the general-purpose runtime. (Of course permission checks e.g. for microphones exist.)
Why do you still need an explicit install step if everything is correctly sandboxed? If your only answer is you don't trust the sandbox then you shouldn't trust the one provided by the OS, either. Your browser's sandbox is tested way more than anything else.
iOS -> Safari
Android -> Chrome
Windows -> Edge (based on Chromium, so fixes in Edge make their way into Chrome too)