There's no reason why applets couldn't have been sandboxed as much as any browser scripting. If they had taken the role JS now occupies, we might have seen that development.