Not even things like batch files and visual basic scripts on windows? Everyone seems to forget we had decades of dodgy scripts and activex controls in our browsers for years before javascript became the thing it is today.

They were never widely disseminated over a network. Office VBA exploits only lasted as a widespread threat until MS locked down macros by default. JS has been around much longer than that.

I can't recall ever needing to run a batch script to read a paragraph on a website, so doesn't seem like a very apt comparison. Are you claiming there's some group of people who have JavaScript disabled but would be happily running Activex if it were still around? Seems reasonable for some people to dislike and disable JavaScript in 2026, even though another, separate group of people had ActiveX enabled in 2009.

pngs in emails are used for this

http headers and CSS is used for this

flash drives left on the ground outside are used for this