Security is a sliding scale. I could stay home all day and wer big pads with sirens on saying "DONT TOUCH ME", but I choose to drive a car at 70mph, walk along-side busy roads and load 1st party JS from sites.
My rationale is that I've chosen to go to a site, and most JS dangers are served from ad networks and trackers. Not typically from the site itself.
I let JavaScript run, but not by default, so it's like "before getting in someone else's car for the first time, I check the brakes work before going 70mph".
Of course, as long as we don't try to force our preferences on each other, we can both browse the web however we like.
My rationale is that I've chosen to go to a site, and most JS dangers are served from ad networks and trackers. Not typically from the site itself.