I'm not complaining about the security implications of running JS code.

I'm complaining about security implications by introducing unnecessary complexity.