'Everyone' cannot all be wrong.
Sure they can. As was said in a Monty Python sketch: "99 percent of all right thinking people are wrong!"
Yes it is.
No it is not.
It's not the only problem though.
That is is certainly true. The more I have been working with "web stuff" in recent years the more I became convinced that the environment that JS lives in in the browser has been deigned for maximum insecurity from the ground up!
With care and effort one can disable a lot of bad stuff now a days when putting together a web site. But really why it's not all disabled by default is beyond me.
As we will soon find out with the arrival of webasm. Which allows almost any language to be compiled into byte codes and sent to your browser.
Memory in C++ is a leaky abstraction .