Doesn't it require a separate process to be using the cryptographic algorithm in the first place in order to fill the cache in question?
If it's done in-process of a malicious app that you're running, why wouldn't the app just steal your password and avoid all of this in the first place?
An efficient and fast version of this in Javascript would be worrisome. But as-is it's not clear if this can be optimized to go faster than 1-2 uninterrupted hours of processing, so hopefully that doesn't end up being the case.