We need 3rd party extensions to manage our keys for us because we're not able to keep passwords and strings of numbers and letters safe I guess...
Although, I think it's more where you're using it to log in that can't keep it safe....
And I think that's a fundamental flaw with nostr.
Imagine Google, FB, or Apple telling you "yeah we can't keep your password safe, you'll have to install this extension by another 3rd party to use our services." That's basically what nostr clients are saying by not allowing nsec login.
Made by devs, for devs... 🙄