You can have the buttons in iframes and have that POST and refresh.
Not saying that's exactly what should be done, but an example that there may be another way than full-on generic code execution wrapping XHR.
Not saying that's exactly what should be done, but an example that there may be another way than full-on generic code execution wrapping XHR.
As what an actual, safe, efficient implementation, of course not.
The point is there could have been a "dynamic HTML" alternate timeline where you could have had interactive pages for 90% of use cases without executing full blown generic computation arbitrary code on the client device.
But worse is better won and now we get insane trackers and cryptominers at every turn because the web can't degrade to exist without JS massaging DOMs.