And yet, if you turn off JavaScript to protect against this type of thing, you end up breaking most financial websites.

(American Express is in fairness the one site that continued working ok as I recall)