For the less crypto-educated of us: outside of an air gapped laptop, wouldn't JS loaded from an HTTPS location be just as secure as most other media? Is the concern that execution on the client-side could be hijacked or snooped after the JS fetch?