pwn2own the browser hacking competition couldn't break Chrome or Firefox in their 2011 stint.
Which is surprising.
		
		
	 
Chrome or Firefox vulnerability (or lack thereof)
Not 3rd party plugins?
Why does connecting to Battlelog over SSL preclude the 
plugin from exploitation? One would hope it had some level of validation that the commands it is handling and sending to the local system to launch BF3 but that is nothing but an assumption. Maybe it does, maybe it does not?
You can already inject code client side to bypass Password requirements to join a server.
The point is that the Plug-In is more surface area for exploitation. How much more surface area depends on it's implementation. The password bypass code injection was worked out in what, no time at all? So as people learn more about the plug-in why is it inconceivable to believe that another, non authorised website can hook into the plugin and pass instruction to the local files which launch BF3?
One assumes the plugin is locked into BF3 files but again, assumption. Maybe DICE/EA coded it in a way to be able to dynamically launch whatever they want with a set of variables passed from browser to local system.
Why is this not seen as a potential issue.
Ideally we want to move towards a plug-in free browsing future. I use a small handful of plugins that are pretty much required for web browsing. Flash, Shockwave.
Installing and using more is not ideal personally. "It's the nature of the web so whatever" is the wrong attitude.
You under-estimate the potential for exploitation, or maybe more accurately - over-estimate the security implemented by the developers. Hell, there have been exploits in code using JPEG images!