15% of browsers? I don't believe it. This has definitely not been my experience. You must be counting scrapers/bots in this total.
Security? The browser sandboxes everything.
Security? The browser sandboxes everything.
Also, browsers aren't bug-free, and enabling Javascript significantly increases the attack surface.
If you disagree with me, and believe it can, I would just love to see a webpage that dumps out valuable data inside my browser. I'll visit it without any browser plugins using the same session I have been using for over a month, promise!