Remember, the more friction, the more churn. “Install this thing in your browser” is a VERY weird UX people are not used to. Add to it relays, interoperability, and a bunch of bitcoiners yelling at you and you shut off a large chunk of potential users.

And remember, in both cases you are trusting the third party (nsecBunker operator or NIP-07 implementation) is not malicious.