>JS is disabled by default

This isn't true any more.

But it still comes with No script built in, so concerned user is left with a choice

I wonder why not. It seems like that's the cause of most of these.

Because the web isn't practically browsable without js, so rather than users fiddling with noscript and ending up disabling a ton of security features, instead they just turned js on.