11% of downloads from npm have a critical known vulnerability so pretending JS isn't happening is going to lead to a major security incident at a big company really quite soon. This will hurt JavaScript in general, not just that company.