It's time to retire javascript and css and any Turing complete scripting/styling, running random code from random websites is just never gonna be safe.
Even just rendering engines can have bugs that can be exploited by specially crafted content. While it reduces the attack surface, it would be a massive hit to usability of web pages.
On that, PDFs run scripts and use graphic libraries, they are not text documents.
I'll take open and a slight risk vs closed and a slight risk.
I don't need anyone's approval to run native apps either, both my PCs run C apps I built from source and shell scripts I wrote myself without it, languages of my choice with implementations simple enough to write myself, not runtimes that literally no one that's not Google can afford to independently maintain. That's real openness.