I completely agree.

However, I still would rather have all the websites I visit pass through my browser’s api than be making straight syscalls.

I think it’s not perfect security but a good line of defense.