The point of a browser's security model is to make it so that "remote code execution" does not mean "arbitrary remote code execution with elevated privileges".

If we really cared we'd only ship data and not code

That's assuming that parsers don't have bugs in them.

Code is data. There is no technical difference, only human interpretative models.

He's obviously talking about shipping only non-executable data.

Correct

Still, is there a difference? If there is a bug in the parser, trip it and what was once non-executable might be executable.

Yes. Without executable client side code you can't do things like heap spraying.

Oh, you totally can. You just have to do it by tricking the parser into going it for you.

I remember having been able to jailbreak my iPhone 3GS for a period of time entirely through visiting a website and letting it exploit such vulnerabilities enough to perform the task. Searching for a related article, appears to have been possible on iOS 4.0/4.0.1:

https://www.cultofmac.com/53323/jailbreakme-2-0-jailbreaks-i...

Edit: I use ‘letting’ above loosely meaning that the specific website mentioned allowed the visitor to control whether the exploit was actually executed or not.