Sure. Yes, security is hard. You got me there. Javascript does not decrease your attack surface, and is not, in fact, magic.

That's not a free-pass negation of my point that crashing a browser tab is substantially less severe than a kernel panic, and thus likewise greater engineering due diligence is needed for its code. There's nothing magical about it.