JavaScript used to be disabled by default but too many users were complaining about pages not working. It's not very useful if you're a CFO trying to leak financial documents to a journalist but the website won't work.

Tech-literate people use JavaScript.enabled=false in about:config.