> what I didn't understand is why Microsoft allows users to run random JS code from Internet with full privileges

The short version is they don't. Cscript and wscript are akin to PowerShell and they aren't talking about JS from the Web.

The way it works is, say, the attacker sends the script (direct) as an email attachment and tricks the target into running it, or sends a document (indirect) that drops and runs the script, and tricks the target into opening that. They've even taken to having executables drop and run scripts to offload malicious activity into otherwise trusted processes without setting off alarms, like injection does.

In the indirect cases, cscript/wscript aren't the only options for JS. You can also:

    rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";new%20ActiveXObject('Shell.Application').ShellExecute('calc.exe');

But Microsoft is overstating the difficulty of detecting these attacks. For example obfuscation isn't a barrier to detection; in fact obfuscation can itself be detected and is a fantastic signal for blocking this stuff. General Windows system behavior, on the other hand, is chaotic[1], so in practice you're limited to writing rules for e.g. what child processes winword.exe isn't allowed to create, but even then you'll need exemptions for certain teams.

1. uTorrent for example creates child processes in a way that's practically indistinguishable from malware:

    C:\WINDOWS\System32\mshta.exe C:\WINDOWS\System32\mshta.exe" "C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\HYD4.tmp.1548293039\HTA\index.hta?utorrent" "C:\5ee283553c4ab530c77f19785f6092cabfd8e48a5eefd808cb53aecea4399dd9" /LOG "C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\HYD4.tmp.1548293039\index.hta.log" /PID "1076" /CID "sDbhVc2tIx6wzwCd" /VERSION "111849449" /BUCKET "0" /SSB "1" /COUNTRY "US" /OS "5.1" /BROWSERS "\"C:\Program Files\Internet Explorer\iexplore.exe\"" /USERTYPE "admin" /ARCHITECTURE "32" /LANG "en" /USERNAME "<USER>" /CLIENT "utorrent""
    C:\WINDOWS\system32\cscript.exe C:\WINDOWS\system32\cscript.exe" "shell_scripts/check_if_cscript_is_working.js""
    C:\WINDOWS\system32\cscript.exe C:\WINDOWS\system32\cscript.exe" shell_scripts/shell_ping_after_close.js "http://i-50.b-000.XYZ.bench.utorrent.com/e?i=50&e=eyJldmVudE5hbWUiOiJoeWRyYTEiLCJhY3Rpb24iOiJmYWlsR2VuZXJhbCIsInR5cGUiOiJpIiwiZXJyb3IiOiJFcnJvcjogVW5hYmxlIHRvIHdhaXQgZm9yIHByb2Nlc3MuOyBmaWxlOiBmaWxlOi8vLmpzOyBsaW5lOiAxMCJ9" "