To give an example, I've seen lots of "antiviruses" inject code or perform unexpected DOM changes, causing certain things to break.
Other times a user shows up with a heavily tweaked browsers that behaves differently from what you'd expect.
Here's a StackExchange question: "How to disable Kaspersky Antivirus javascript injection?" [0].
And on Reddit: "PSA: Kaspersky injects remote javascript into all your pages. Even secure ones." [1].
[0] https://superuser.com/questions/981959/how-to-disable-kasper...
[1] https://www.reddit.com/r/privacy/comments/3frjqw/psa_kaspers...
I stick with Flow for now just because create-react-app doesn't support officially TypeScript, but it should be possible with the next major version that will include Babel 7.