What code is "safe" isn't necessarily something that's set in stone. Exploits could easily deliver code that looks safe but causes problems. And each new version could introduce a new exploit.

And then there's the upcoming WebAssembly, which is bound to be ruined by ad networks in the future.