The most common reason I get, professionally, is that it "prevents scripting" ... as if hackers are both using Chrome extensions at scale but also can't figure

The most common reason I get, professionally, is that it "prevents scripting" ... as if hackers are both using Chrome extensions at scale but also can't figure out how to defeat javascript and html form restrictions.