This is an Android feature to which Chrome simply adheres, I believe. I guess Firefox simply does not adhere to it.
Installed (native) applications can define URL patterns that are supposed to be related to them. When the user navigates to those URLs (via the built in browser or via Chrome), the user is usually presented with an option to view the URL in the browser, or use the native application instead.

So it is not so much that web application can run native applications, but that native applications explicitly requests that certain URLs will launch them.

This is probably by design.

*request

And the user can usually choose to always use that application without being asked in the future.

Oh, another way is to use the intent URL syntax -
https://developer.chrome.com/multidevice/android/intents
Come to think about it, Faceook is probably using that.

(Sorry for the spam)
And if it does use the intent URL syntax, it cannot know whether the application is installed (unless it is their application, obviously, in which case they can signal using an HTTP request or something) or not , so no real security or privacy risk.
(Unless the native application lets you pay immediately by using an intent, without any confirmation, which makes it a security risk of the native application, not the browser)

"the user is usually presented with an option to view the URL in the browser, or use the native application instead" ... "And the user can usually choose to always use that application without being asked in the future."

I don't remember allowing Chrome to open any native applications. They start automatically. I can't even find a way to forbid it in Chrome :(

Are these intent URLs a standardized web thing? Or Android is making webmasters to make Android-dependent websites?

"it cannot know whether the application is installed"

Should that make me happy, that you don't give the full list of all my installed apps to every webpage? Thansk! :D I was talking about cases, when a webpage tries to start a native app without knowing for sure, that such app is present. If it is, then the native app, that knows your credentials, may contact the server, that you are logged in. The server will match these credentials with your IP address (or simply by comparing the timestamps of requests from the browser and from the native app) and let the website know, that it is you. That is a security risk. No native apps should be allowed to be started from the browser, without a user allowing it explicitly.

I think Safari allows this as well (I understand it does not necessarily make this right).

I am not sure Hotlist-Interop is related here, but I am keeping it just in case.

Much like this bug:
https://bugs.chromium.org/p/chromium/issues/detail?id=698470#c8

This is up to Facebook to determine how links are handled, and they choose to have the messenger app be the only supported way for interacting with it.

This would require a policy change at Facebook and not something Chrome will be able to handle.