It's a fine place to run code trusted by the server (or code trusted by the client within the scope of the app). But for code not trusted by either, it's bad -

It's a fine place to run code trusted by the server (or code trusted by the client within the scope of the app). But for code not trusted by either, it's bad -- user data in the app can be compromised/exfiltrated. Hence for third-party plugins for a web app, the built-in JS runtime doesn't have sufficient trust management capability.