Microsoft defends it as a 'design choice,' saying the threat requires the PC to be compromised. But the researcher who flagged the issue says other Chromium-based browsers sidestep the problem.