Are JS-based exploits a real threat anymore? Even if you do find an exploit, it looks to be an uphill battle, because you still have layers of security to break through, and they're going to differ by target OS and browser. Even on platforms where things are fairly predictable, like say game consoles, the exploits look complicated and are often not very reliable.

Even in Firefox where the security story is still not quite as far along, I still am not really concerned about JS exploits. And most people now run browsers that automatically update. Few parties are going to spend that much money just for it to only be useful for a limited number of targets.

Now that Flash Player and ActiveX are pretty much gone from desktop browsers for most users, I feel the game has changed. People now need to be much more concerned with phishing, XSS, and other flaws. Social engineering is probably more of a threat to the general public than browser exploits.

(I do use firejail to sandbox my Firefox instance from the rest of my machine, but that's more a layer of last defense, and doesn't really prevent too much.)