Microsoft was utterly reckless with ActiveX (as with much of their other tech) as I see things, whereas JS has had a lot of attention from people who care and know what they are doing.
https://nvd.nist.gov/vuln/detail/cve-2026-85046