And this is just the simple obfuscation case... I can easily imagine where we simply disable eval completely, (except in specific scenarios perhaps). At it's

And this is just the simple obfuscation case... I can easily imagine where we simply disable eval completely, (except in specific scenarios perhaps). At it's core the issue is dynamism itself. I don't think it should be forsaken, but the issue is, yes, JS does a terrible job of making it explicit. If the language itself required a matter of explicitly, then it would make the whole attack generally more difficult to pull off.