Photo editing could be designed in such a way that the JS code does not actually get read access to the canvas - it just specifies transformations.

It's becoming very clear I think that having this level of control for web apps is more detrimental than it is a positive. Leave rich apps to the OS, and keep the web as untrackable as possible.