> Barring some serious security gaps, JS isn't even capable of doing anything more than lock up the browser and maybe send some extremely minimal information about you back to someone elses server.

Not true. First JavaScript Rowhammer exploit was publicized in 2015: https://www.youtube.com/watch?v=9L5MJ43nbkI