But what about the sourcecode problem?

Native Client doesn't deliver the source code, so you cannot change it easily which makes it a lot harder for the user of web applications.

BTW, what if there's yet another CPU bug which can halt the CPU or cause privilege escalation?