Many security-minded folks think that "auto run arbitrary code from random websites" is more dangerous than the alternative. Indeed, this isanifestly true. Many sites should be able to provide a useful service without JavaScript. Sure, that's unreasonable for some sites (like Google docs), but for others it is perfectly reasonable.