1) Introducing scripting to the web can introduce security concerns, but this is the wrong way to think about interconnected systems. By far the greater security concern is trust models built over anonymous connections. When you can eliminate anonymity or the security implications therein most of the security issues that arise from the availability of scripting are like wise mitigated.

2) The greatest difference between JavaScript and Java is that Java will force OOP on you, in JavaScript functions are first-class citizens, and the scope model is always lexical. I abhor OOP and completely avoid the ambiguity of inheritance and keyword pronouns when writing JavaScript. Always choose composition over inheritance. When I see people intentionally do otherwise I immediately assume they have no idea what they are doing.