Carmack is right - there are security risks with allowing web content to run GPU shaders.
But Microsoft is inconsistent since it allows Silverlight content to run GPU shaders - proving that while there are risks, they are manageable, especially with Microsoft's deep security measures in recent Windows versions.
The issues with drivers can be and are being mitigated. The question is will Microsoft support WebGL once drivers are secure? I still doubt it, for the business reasons.
And Carmack is not precisely known as a MS cheerleader.