It's the generic HN snark that pushes for no JS websites for everything, without considering the benefits of users having such a powerful VM that probably protected them from running random executables.
Back then JavaScript was to be used solely for non-critical, nice-to-have optional functionality that would regardless not inhibit the user; using JavaScript was contingent on your website gracefully falling back to a perfectly usable state in its absense. If your page failed to load without JavaScript, you were doing it wrong. If your JavaScript hassled your users, you were doing it wrong.
I lament that that philosophy got thrown out the window some time in the early 2010s, which subsequently led to the hellscape of websites filled to its armpits with JavaShit that serve no good purpose which we see today.
With the rise of mobile browsers, the ability for frameworks to solve cross-browser comparability, and the general acceptance that anything beyond trivial interaction required JS, catering to a tiny crowd that didn’t like having it turned on became very unimportant to most. I do agree that graceful degradation to a state that’s still functional is ideal and something I wish had stuck around.
The problem with JS in browser has been security, specifically cross origin not that JS is code
There were warnings from the beginning (both with ActiveX and NPAPI), but for most engineers, getting things done took precedence over trust issues. Youtube, for example, would not have been possible until much later without Flash.
I honestly can't see a much better compromise than JS to include the common users.
But, it was easier to avoid this common error before every site depended on it.
At one time? When? People have been executing arbitrary and malicious code since the moment they could share it between two computers.