> but giving a 2B model full JS execution privileges on a live page is a bit sketchy from a security standpoint.

Every webpage I've ever visited has full JS execution privileges and I trust half of them less than an LLM

Note that every webpage does not have full JS execution privileges on other parts of the web.