What is JavaScript except code being remotely executed?

It's code being executed in a well-tested sandbox that should not be able to steal your machine's secrets, so it's appropriate to freak out over the fact that these attacks allowed it to do that.

It's code that can run for arbitrary amounts which can't be killed without killing the browser and affecting _other_ services to.

It's user hostile code executed by foreign entities on devices that you are supposed to "own"

In recent browsers you can certainly kill just one tab's JavaScript without taking out anything else.

It doesn't feel very different to printing a PostScript file to me. You're giving someone access to run their "arbitrary code" in a VM on your system with very limited permissions.