The attack surface of browsers is relatively small if you keep them up to date. Browsers were early in including meltdown and spectre. Running JavaScript is pretty harmless.

On the other hand https makes the web performance horrible