Yes, it doesn't need to be default. But comparing C and JS doesn't make much sense here. It's easy to avoid using innerHTML and similar. You can just turn those

Yes, it doesn't need to be default. But comparing C and JS doesn't make much sense here. It's easy to avoid using innerHTML and similar. You can just turn those functions off, if you don't trust yourself to not type them out from time to time in your editor, or if you don't trust your dependencies to not use them. There's nothing unsafe about having context isolation off, per se. Yes, you can do stupid stuff like run code directly from the internet, but context isolation doesn't prevent that. It still allows RCE. It just limits the fallout to just stealing your data, like with any other XSS on regular websites. And if programmers can't be trusted to not execute untrusted input as code in more secure context, adding an extra hop via some IPC will not save them, if they make the same mistakes in less secure context.