The security model and runtime requirements are completely different between making an HTTP request and executing arbitrary code.

They have different tradeoffs.