When you send code to the client, you're programming computers you did not spec, of a vintage you can't know, struggling under AV/malware you can't remove, in a browser you can barely identify, w/ extensions that do wild things, over networks serviced by carrier pigeon (probably)