I'll be the first to lament the spread of javascript, SPAs, and the huge hit to accessibility that the web has taken over the years. None of that changes that

I'll be the first to lament the spread of javascript, SPAs, and the huge hit to accessibility that the web has taken over the years. None of that changes that js adds incredible power to what webpages can do and there is zero chance of rolling back browser-delivered applications at this point. I also don't understand why you think html+css doesn't have the same fundamental 'code execution' flaw - you're accepting unseen input from a remote source and feeding it into an execution engine which will have exploits - whether that's css or html or js or xml or *. Back to your question though: yes, 98% of web users want remote code execution on because they want spotify, facebook, and youtube to work. They would be upset if they even had to manually go in and enable it. And I'm not even sure you could make a quality version of those sites without js.