...from sources which some people find uncomfortable to be blindly trusting. From a security perspective, it's a huge attack vector - the majority of browser exploits require JS to work. Even if it's sandboxed, there's also the annoyance aspect; scripts can consume CPU and do all sorts of irritating things like breaking the back button and seizure-inducing animations.