>forbidding embedded JS altogether which removes the attack vector for malware

The more worrying ones I've seen don't rely on JS but are just links to bad sites. Downloading software can be a bit ridiculous these days with alongside the main download button about five ads saying "Download Now" linking to god knows what iffy software.