Nah I read that, and it makes sense.

Also, you're wrong about the Python approach. Yes, Python does run locally, but you're only using it to run a preinstalled web server module that it ships with, which will make all the files in the local directory accessible to the browser in a way that doesn't require breaking its sandbox.

As long as your Python installation is from a legit source, this is fairly safe. Running it this way will NOT execute any code from that directory – the browser will only be able to access files from the directory you started the server in, nothing else.

In that sense, the using Node is actually more risky, because that WILL run code outside the browser's sandbox, and they could technically smuggle anything in there.