I don't see how Javascript is to blame here, which is I think what the author is implying with the "game over" link to slides about JS insecurity. This attack

I don't see how Javascript is to blame here, which is I think what the author is implying with the "game over" link to slides about JS insecurity. This attack only worked because the attacker could subvert the same-domain origin policy, by posting usernames and passwords to a page at the facebook.com domain (but which was routed to an attacker's host at a lower level.) The security failure happened at a lower layer than where Javascript security would be responsible.