Maybe because JS files (specifically add-ons) run from the local filesystem are given escalated privileges compared to normal usage, perhaps for ease of development. I'm just speculating, though.