As I've mentioned elsewhere, the delta is control over login/logout, much easier/low friction deployment of policies, live policy changes, centralized security related logging, additional features like built-in DLP, corporate VPN/proxy, device posture checks, profile encryption, forced update/restart, guaranteed support, etc etc.
You also get the ability to deploy all browser infrastructure on-premise, to effectively decouple yourselves from us and get sync data, telemetry, and so on all stored on-prem, serve updates from your own servers, etc. This is something that wasn't really practical before.
I'm not sure why we would be okay with breaking a browser's trust in that way
I'm not sure what you mean here. If we accept that this is something a lot of Enterprise deployments require, wouldn't you prefer to have things like DLP, VPN and security logging be built-in in the browser, rather than being provided by third-party products that intercept or hook the browser traffic somehow?
You also get the ability to deploy all browser infrastructure on-premise, to effectively decouple yourselves from us and get sync data, telemetry, and so on all stored on-prem, serve updates from your own servers, etc. This is something that wasn't really practical before.
I'm not sure why we would be okay with breaking a browser's trust in that way
I'm not sure what you mean here. If we accept that this is something a lot of Enterprise deployments require, wouldn't you prefer to have things like DLP, VPN and security logging be built-in in the browser, rather than being provided by third-party products that intercept or hook the browser traffic somehow?