Well the same could be said for steemconnect, but with the browser extension there's at least the option to download the code and run it locally, or use the Brave browser which I believe doesn't auto-update. Additionally it's much more familiar to people who use Ethereum dapps (aka most people in the crypto space). They are used to using Metamask and are rightfully very wary of putting private keys into a website.

Also from a user experience perspective keychain is so much easier. You never have to worry about where you saved your keys and copying/pasting them, especially if you have multiple accounts. You just type in the username you want and you're good to go.