It's harder to verify that a program doesn't violate the browser's security policies and try to get out of the sandbox. That's why NaCl is such an impressive project.