In both cases, the server is the thing that's actually in control. Your browser doesn't know if code is malicious or not and has no choice but to run it as the

In both cases, the server is the thing that's actually in control. Your browser doesn't know if code is malicious or not and has no choice but to run it as the server says to. The server, on the other hand, does know if some text is potentially malicious and can take steps to prevent it from being malicious. So the server is responsible in both cases because it has all the knowledge necessary. If the browser tried to prevent code execution then no code would execute. It can't know the original origin of the text.