". Most merchants outsource to third party card processing facilities (which won’t be mentioned here), typically redirecting to a page on that providers website, for accepting payments. The problem with this is that they often serve proprietary JavaScript"
The browser running the javascript can be free/libre, the OS it is running on can be free/libre, the javascript language and browser environment is relatively standardized, it's sandboxed ... The JS is really just part of the page and/or service API.
FSF doesn't have as big a problem calling banks that use closed-source telephony software or making api requests to closed-source webserver backends, there's really not that big a difference from a fully free/libre client interpreting a script in a standardized sandboxed environment, which it just received from a service, as part of using that service.
The other odd FSF corner-case is that firmware blobs that you can't update are OK, but firmware blobs that you can update are not OK (even if they are freely redistributable). I'd say having a hardline stance on this is just not helpful.
On firmware, the FSF has drawn a bright line on where hardware ends and software starts, and where they've drawn it is on whether firmware on device can be updated or not. If its not updatable, its a piece of hardware, plain and simple. If its updatable, then it is software, thus said code should be freely licensed and not Tivoized.