Is a browser on compromised hardware supposed to be more secure than an app? Amazon, steam etc still risk exposing accounts authorized to make payments using your money. It's easy to think "I just won't use banks" and underestimate the risks of doing anything on compromised hardware, and the answer isn't to play the "what could possibly go wrong" game, it's to not use compromised hardware.