What I don't understand is why the browsers and OSs aren't preventing this. This is a massive security hole.

An app doesn't need access to the clipboard unless I'm actively pasting to it while it's in focus.