> That return path can be a vector

What return path could possibly lead to a RCE? That's crazy, no telemetry requires "backend could return any command that gets run on the client", you're doing telemetry in a very non-standard way if this is even possible.

At worst, the telemetry backend might first send the client a config, but none of that would contain executable commands because again, that'd be crazy.

> we cannot absolutely claim that browsers don’t have RCE(s).

Of course, you can never prove the absence of bugs (and/or security issues), but given that browsers aren't wildly exploited at this very moment, nor have been for quite some time, we can pretty confidently claim there are no browser RCEs in wide use today.

It's true that browsers have pretty big attack surface, but it's also true that it's the class of software that gets the more pentesting, since the payoff would be so great when you manage to find holes.