This is a great point, and something I often wonder about as well. I think it&#x27;s reasonable to think that only a compromised site or site run by someone with ill-intent would pose any real risk. And in such a scenario, it&#x27;s going to get out pretty quickly that the site is compromised&#x2F;dangerous.<p>While this doesn&#x27;t help that theoretical set of initial victims, it just doesn&#x27;t feel like a credible risk worthy of too much worry, especially for information from higher profile sites with reputable backing.<p>Perhaps the solution here is better mechanisms for validating what a script can do - &quot;script is attempting to access xyz, allow? y&#x2F;n&quot;.