Malicious JS is fairly common on laptops... just see all the cryptominers.

The "put a big moat around it" approach to security should be put to rest. We isolate system processes and user accounts for good reason.