That has nothing to do with javascript-the-language, but rather the way the web works. Obviously even with https, javascript delivered by a web server has a vulnerability whereby the web server may be compromised, which is outside of the users control. Any javscript delivered by a web server should be executed with that understanding. i.e., delivering a wallet from a web server is probably not the right thing to do. Note that javascript can also be run in the form of a browser extension, server-side node, node-webkit, apache cordova, etc. Javascript-the-language is not intrinsically vulnerable to a compromised webserver.