That's how the system or browser should be configured. Secure by default and any insecurity must be an opt-in. But Google won't do it because their websites are JS heavy monster trucks and millions of websites run their tracking scripts which require JIT enabled by default for optimal page load.