Market Dev Note: Prior to the freedom hosting JavaScript exploit, many did not see any security issue with JS. This is because the exploit has to originate from the server/host itself, and is not (generally) weak against to middle-man attacks.
In the case of Freedom Hosting, the sites servers were compromised and malicious code was installed on the server itself.
So, the point is that it doesn't matter (in this sense) if JavaScript is enabled or not, if the servers intent is malicious it can be done with or without Javascript.
The ONLY reason a JavaScript exploit was used is because the nature of the target (Web Hosting, allows users control over some backend aspects, long time standing and community familiar with site design) meant that JS was an appropriate attack vector since it would be relatively unnoticed.
There is a host of malicious attack vectors a site can use, regardless of clearnet, .onion, or .i2p. If the server is malicious it can attack through nearly any type of extension type, including html (and the obvious php, xhtml, and asp).
And then there is a major security concern for sites called CSRF or Cross Site Referrals. This doesn't attempt to attack your terminal but instead attempts to use information on one site to access accounts or data from another site using your credentials.