In the end its security features of Mailstore that are interfering here (and usually for the right reasons). Mailstore seemingly sets a “content security policy” (csp for short) that prevents that it gets embedded from other domains (like you have webapp at https://kopano.domain.com/webapp and mailstore at https://mailstore.domain.com, using a different port for both also makes it a different domain for the browser).
DeskApp is configured to ignore this by default, that is also why there is a WhatsApp plugin only for DeskApp and not for WebApp itself.
What are your options? You could modify the webserver serving Mailstore to override the csp to allow embedding from your WebApp domain. We have been doing something similar when it came to the integration of Mattermost into Kopano WebApp.