I get not wanting to forward JS in email messages onto your customers whose browsers will run it and forward your login cookies to criminals. I do not get thin

I get not wanting to forward JS in email messages onto your customers whose browsers will run it and forward your login cookies to criminals. I do not get thinking that replacing the word "eval" with "review" is a solution to that problem.