That is misleading. An ActiveX control has the same permissions as the IE process hosting it. A malicious ActiveX control can hijack your browser, and do any number of other things.
A NaCl app can only interact with the system through a restricted syscall interface. That's it.
A NaCl app can only interact with the system through a restricted syscall interface. That's it.