As an SWE who used to work on Internet Explorer (yeah, laugh), I know I can't say that JS is somehow impervious to possible attacks and privilege-escalation out of the browser-imposed sandbox (which can and does happen), but when one compares even the basic nature of Flash's plugin/ActiveX control vs modern browser JS engines, the threat-model and browser-vendors' mitigation strategy, it means I have easily 100x more trust in in-browser JS as a far, far "safe"-er environment than Flash.