The claim that you need to disable JavaScript to be secure is bullshit anyway, otherwise disabling JavaScript would be standard practice in any security-critical environment such as high-level government offices, which it most certainly isn’t.