We see JS as insecure because we can turn it off, and it's history is pretty bad. We can't turn off parsing, rendering, and other features necessary to display

We see JS as insecure because we can turn it off, and it's history is pretty bad. We can't turn off parsing, rendering, and other features necessary to display a webpage - and those are just as well exploited. JS at least gets multi layered sandboxing and isolation. Modern browsers are not well fit for security and anonymity. Torbrowser is the only one that actually removes tracking data and the wider attack surfaces of modern browser features like webgl. However it's still not 'secure'. You still have plenty of features that come from complex codebases, such as media decoders.