why do we assume automatically that this is a bad thing? it all depends how it is used. I for one see many positive uses for something like this.
It's more secure. If identifying session data is not accessible to JavaScript, it makes a site more secure from XSS attacks.
HTTPOnly should take care of this.
https://www.owasp.org/index.php/HttpOnly#Browsers_Supporting...