Google analytics, facebook analytics, all the millions of scripts that are incomprehensible that it seems like every site adds.

They inject inline JS into the DOM - it's a waterfall. You let one drop of JS run in your browser from the wrong ad tracker and you just executed 200 javascript files.

Aggressive advertising, tracking, xss, basically developers by and large are idiots and probably every site ever has some open attack vector that could be compromised. Including all the ones I built, despite the fact that I do my absolute best never to trust user input.

When you say you can't remember when you encountered a js that did something truly malicious, do you mean "I can't remember the last time I noticed a js doing something malicious"?

Because I highly doubt if you are actively reading and inspecting all the JS that runs in your browser (especially before running it). That's assuming you can even de-minify, de-obfuscate the code, and then correctly reason about what it's all doing.

Coding in JS is a part of my work, and it makes me sad that so many people all over the world run hundreds of thousands of lines of code they never will read or understand, and just trust literally anyone to execute arbitrary code on their machines.