TorBrowser has Javascript disabled by default, doesn't that mean you have to first 'trick' targets into visiting the webpage, and then trick them into turning on js?
It's IE-specific, though, so won't work in a Tor browser.
[1]: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/bg...
The first thing one should do after installing the Tor Browser Bundle is open up about:config, search for javascript.enabled, and set it to false.
If an onion site doesn't work without JS, you probably don't want to be on it anyway.
from: https://tails.boum.org/doc/anonymous_internet/Tor_Browser/#i...
To allow more control over JavaScript, for example to disable JavaScript completely on some websites, Tor Browser includes the NoScript extension.
By default, NoScript is disabled and some JavaScript is allowed by the Torbutton extension as explained above.
So, "Yes", this is reckless and would compromise Tor Browser from the outset.
Maybe so, but I think the GP is correct. At least, it was true a year or so ago.