Developers are perfectly fine with writing insecure JS all by themselves.