needs its capabilities restricted

This is a bad take. How are you gonna do that? Force ECMA to scrap all the functionality deemed ‘bad’? Wave a magic tech wand? At the end of the day JS is a tool, and like any tool it can be abused for nefarious purposes. The issue is that advertisers abuse this tool, and the sites they pay to be shown on allow it. Not because insert scripting language exists.