> they download and execute external JavaScript

Yes, but they may do so only by embedding Apple's own sandboxed WebKit component. So the downloading, execution, and results are tightly controlled.