That means at one point, their security model did not prevent malicious javascript. They may have stopped allowing it, but why trust that they've changed their

That means at one point, their security model did not prevent malicious javascript. They may have stopped allowing it, but why trust that they've changed their model? It's not like they were audited or something, and they're known to have not cared about javascript security as recently as 6 months ago. I see no reason to trust them.