Things have changed and more and more people run with javascript enabled, and more and more website stakeholders are willing to put up with things being broken for users who don't have it enabled. I know that's a contentious statement, but it's true. If Google Analytics and ads aren't being pushed down to you because javascript is disabled, most site owners are willing to put up with the experience being broken for you too. I'll sidestep the debate of graceful degradation.
Now however, there are performance reasons for going "pure CSS". A lot of CSS transforms and animations are hardware accelerated and/or just animate more fluidly than they would if they were animated via javascript. Javascript is single threaded, and when a webpage is doing a ton of varied activities, it's hard to ensure fluid animation when the only tools at your disposal for drawing frames are pretty crude methods like setTimeout.
At BigDoor, we ship the same JavaScript code to many different partners, but their widgets can have very different form factors and visual effects. It's nice to not have to distribute a bunch of animation code to every partner just in case one partner's theme happens to use it – we can keep it in the CSS and just swap that out.
Soon I think people will see that using JavaScript for the simple animations they've been performing all this time (fade out, slide in, etc.) is just creating a tightly coupled system.
Using CSS for non-turing-complete interactions which are limited in their computational ability to a simple automaton means that CSS can be trusted much more than JS, and that there are stricter guarantees on performance. It's also semantically cleaner when used for things like visual effects on windows, because even if CSS doesn't load, the markup representing the menu will be intact. JS systems have the ability to load markup asynchronously or generate it from other data in the page and destroy all notion of graceful degradation.
More complexity leading to bigger surface area for potential attacks, yes. GPU and file access, yes. But nothing to do with turing completeness.
Here's a non turing complete language I wouldn't like to be able to run in a web context. It has a single command: rm {path}
On the other hand a turing complete language that has no access to any IO, DOM manipulation etc. I would be perfectly happy to let run.
It isn't the power that comes from turing completeness that makes javascript a potential security vulnerability, it's the interactions it can have outside of computation.
By using the language of Least Power (timbl@w3c.org) that still accomplishes your task, you achieve a more concise and more analyzable document.
I wouldn't call that "nothing to do with TC".
Non TC languages can be sufficiently complex as to make analysis difficult.
I don't see any of the risks of js as linked to TC in any meaningful way beyond a very hand-wavey "TC tends to lead to complexness".
There might be some inherent value of avoiding javascript, but I think this is just a hack for the satisfaction of being able to do it.
CSS transitions are faster than JavaScript animations[1].
Browser could easily optimize them (since each keyframes are predefined) vs. DOM manipulation, which is always slow.