So your threat model is state level hackers?

On desktop PC’s?

Any malicious actor in the universe would love to be able to make a bot net out of 90% of the worlds computers, doesn’t make it any less plausible out of movies

Root access on any of these platforms would still result in persistent low level system access

Jesus H Christ youre running your browser as root?

Unless you mean an oceans 11-esque double zero-day exploit that jacks the userspace browser, stacked on a root-level privilege escalation zero-day on arguably the most secure OS in the world.

I think we have insanely different threat models