"Since Googlebot executes Javascript, this allows an attacker to craft XSS URLs that can manipulate the content of victim sites."

In some imaginary future with ubiquitous headless browser-based bots, having Javascript disabled might actually be a good test for "Are you human?"