The actual reason for this is web advertising took off like wildfire, using 3rd party scripts. It was too late to reverse by the time people got concerned about the security model.

Content Security Policy makes all this much more robust in modern browsers.