It was incredibly common to see Windows installs utterly compromised by ActiveX controls doing god-knows-what, to both the infected computer and every other computer on the corporate network.
The damage to individuals and the economy in terms of lost productivity and compromised personal information directly attributable to ActiveX's "compromise my system by design" nature is incalculable.
To compare that to Javascript is rather spectacular.
If you want to argue that Javascript has been able to wreak more damage over time precisely because it's not as objectively insane and immediately destructive as ActiveX, well fine. It could be said that Javascript is Covid-19 to ActiveX's ebolavirus. Ebola is so wantonly destructive that it kills many of its victims before they have a chance to infect others, whereas Covid's less-awful nature has actually allowed it to harm more people over time and is now probably here to stay, like influenza.
Flash was an abonimation, yet you could disable it with barely any consequences. Same with ActiveX.
This was very nearly not the case.
IE/Win had close to 100% market share at one point. We were a hair's breadth away from a future where you could, in fact, not disable ActiveX without shutting yourself off from much of the web, like Javascript today.
South Korea was actually there for a time. If you wanted to spend money online, various regulations meant running ActiveX was a requirement.