This is mostly the case because most solutions provide more than the bare minimum of DOM rendering and event binding that a web view originally entails. Once you "accidentally" ship an entire browser inside your app, you've opened up more vectors for vulnerabilities—such is the price of humanity's hubris in attempting omnipotence.

Then second aspect is the "well-hidden" JS runtime or the general dislike of Javascript, but this point has been explained by other commenters well enough.