Is the average javascript developer responsible for the horrible security model and the dubious javascript-accessable features added every year to web browsers?
This is like saying developers of MS Windows applications are responsible for the horrible period of Windows worms we had a decade or so ago before MS started to get more serious about security.
The front-end community is responsible for forcing it to be used on most sites even for basic functionality like reading an article.
It's not.
Javascript developers have done more to erode privacy, openness, and trust on the Web than anyone else.
Why would I, a reasonably savvy aerospace engineer who doesn't even know all the dirty little tracking tricks, even consider for one second enabling js by default?
At best I am "just" increasing some scumbag advertiser's profit. At worst I am going to catch something nasty.