I can't think of a way of getting malware from JavaScript anymore than from a simple link, that's just plain false.

The move to "web-page-apps" is not about eye candy, it's about speed, responsiveness and yes, usability. About not trying to awkwardly force an app down the http/html way.

A broken website/app is simply broken: if things do not work as expected, that's not the fault of webapps per se or JavaScript - it's all doable and not a big deal anymore (the back button thing).