Sorry, I updated my comment to sound a little less argumentative. Somehow it always comes out wrong .. I've done my dues in network admin and I can assure you

Sorry, I updated my comment to sound a little less argumentative. Somehow it always comes out wrong .. I've done my dues in network admin and I can assure you that informed users like yourself are in the minority. I've only ever known a couple of people who turned off JS as a matter of course and they did so for all the wrong reasons, as I mentioned above. I am sure you can imagine the type of "power user" I am talking about. Anyone who is actually informed about these security issues tends to mitigate them behaviourally. It's like antivirus. Most of the clued-up tech people I know do not constantly run antivirus software; they don't need to because they never take any action which might lead to virus infection. They might scan once a week or month or something. It's the same with JS, IMO - if you know about the real issues with it, you also know how to avoid them, and you wouldn't ham-fistedly cripple the rest of your browsing experience in the process.