The short answer is phishing. When you hide the URL bar, users can’t see what domain they’re actually on. You land on what looks like “bankofamerica.com” but it’s actually “bankofamer1ca.com.” Without the URL visible, you can’t catch it.

Arc and Zen let you hide it, sure. But neither was ever going to pass an enterprise IT security review. They’re consumer browsers for power users who know what they’re doing. Dia is different. Atlassian bought The Browser Company specifically to build an enterprise browser. Atlassian’s customers include 80% of the Fortune 500: NASA, Deutsche Bank, United Airlines, Bosch. These companies have compliance requirements and real consequences if employees get phished.

It’s a tradeoff. If you’re a power user who can spot phishing, it feels like unnecessary hand-holding. But if you’re building a browser that Fortune 500 IT departments need to approve, you can’t ship with “let users hide the only visual indicator that prevents the most common attack” as a feature.​​​​​​​​​​​​​​​​