there's no sane default and websites want to spy on you

If you're considering E2EE you're already considering that the server cannot be trusted (AKA it wants to spy on you).

It's not about defaults, it's about the fact that you're doing crypto to protect yourself from the server, using code that the server just sent you.

This is the key point of the post:

Where installation of native code is increasingly restrained through the use of cryptographic signatures and software update systems which check multiple digital signatures to prevent compromise (not to mention the browser extension ecosystems which provide similar features), the web itself just grabs and implicitly trusts whatever files it happens to find on a given server at a given time.

It is doable, it's just not done well. To just send everything in plaintext is definitely not the solution here.

If you're serious about security, the only good way to do it is to not do it at all. It really pisses me off that even password manager don't care.