The stuff like Flash, Java applets and Silverlight it eventually replaced were arguably even worse. There’s a legitimate need to run client-side code at times, IMHO the mistake was making it so permissive by default. Blaming the language for the bad browser security model is kind of throwing away the baby with the bathwater.
The user is describing iOS’ share sheet, which Signal seems to advertise as a feature. The OS isn’t reaching in and grabbing data, Signal is providing data to the OS.
Also note that said user signaled this on the Signal-Android repo, which combined with their inability to find this info, when i don’t even own an iOS device, makes me think they aren’t the most observant user out there.
I’d love to share your optimism, especially regarding that last sentence. As long as Google controls the most popular web browser out there, I don’t see the arms race ever stopping, they’ll just come up with something else. It wouldn’t be the first time they push towards something nobody asked for that only benefits themselves.