Security concerns here are overblown, and this is IMHO more useful than WebRTC. This is how it should have been done to begin with, as well as the ugly hack known as web sockets.

There should be some restrictions. No ports under 1024 without asking the user would go a long way.

Anyone saying “the web isn’t an application platform” needs to just accept reality. That ship sailed almost 20 years ago.