And jsx was kind of weird because e4x existed (and was never widespread, and implementations of it went away).

I suppose the important part was that jsx needed to be compiled, which means it couldn't introduce any new security issues…