Open browsers have open, auditable Javascript engines. There can be vulnerabilities, but you aren't waiting for some company to put out a closed patch containin

Open browsers have open, auditable Javascript engines. There can be vulnerabilities, but you aren't waiting for some company to put out a closed patch containing a fix. EME blobs are like Flash plugin blobs. So, it's similar in the sense that enabling JS increases the potential attack surface, just like installing EME/Flash/whatever does. But at least the JS engine can be examined by whoever wants to.