It doesn’t break that often.

You’re paying for redundancies in different regions, migrations, backups, upgrades, maintenance, generally not having to worry about losing your data. The storage costs nothing.

That doesn’t address the original point which is whatever’s shared has to exist on all machines.

Either way, you would need to backup your data if you were self hosting Nextcloud or friends so you do need multiple copies of it anyway.

Malware targeting individuals rather than servers do not need privilege escalation. They just need to run as the user and swipe cookies/credentials/wallets etc. Privilege escalation would allow them to do catastrophic damage but that’s not the point in that case.

I know Brave is controversial but they were the only ones (edit: not sure about Vanadium, I’m curious if they were vulnerable) disallowing JS to access localhost thus blocking Meta and Yandex’s recently discovered spying.

Sounds like such a no brainer to not allow random websites to communicate with the localhost and very easily circumvent all sandboxing you spent thousands of hours building. Looking at you Android (Google) and all the browser vendors (also Google?, huh).