Perhaps the web was more secure when it wasn't running anything—just serving up static web pages?
But 99% of web applications are forms and displaying stuff. All JS accomplished is making it look prettier and enhanced tracking.
I mean, Facebook, my bank, Amazon… these can all be created with no client side code. It would be a lot of refreshes, but it can be done.
If you want a wildly interactive art experience, just load the appropriate browser for that.
I think it's just a keeping-up-with-the-jonses sort of thing: If the restaurant down the street has a flashy website then I guess we need one too. Having restaurants in competition over the quality if their website is a negative sum game because it distracts them from the food.
HN could too - perhaps the biggest use on HN is not refreshing when up (or down) voting something. YouTube could do something similar - refreshing when 'liking' a video or getting more comments. But would you really find those to be a better experience for you? Even on actions that HN does refresh on, such as 'Next page', or submitting a comment, HN doesn't freeze sorts, so posts and/or comments you didn't see will often invisibly end up before the new location HN sent you to (or posts/comments you already saw earlier in the list now showing up "again" later in the list).
Not saying that's exactly what should be done, but an example that there may be another way than full-on generic code execution wrapping XHR.
As what an actual, safe, efficient implementation, of course not.
The point is there could have been a "dynamic HTML" alternate timeline where you could have had interactive pages for 90% of use cases without executing full blown generic computation arbitrary code on the client device.
But worse is better won and now we get insane trackers and cryptominers at every turn because the web can't degrade to exist without JS massaging DOMs.