Which is why the HTML5 spec explicitly mentions disabling scripting?

"6.1.2 Enabling and disabling scripting

Scripting is enabled in a browsing context when all of the following conditions are true:

    The user agent supports scripting.
    The user has not disabled scripting for this browsing context at this time. (User agents may provide users with the option to disable scripting globally, or in a finer-grained manner, e.g. on a per-origin basis.)
    The browsing context's active document's active sandboxing flag set does not have its sandboxed scripts browsing context flag set.
"