>So far, they are a much less attractive target to malware authors than web browsers are. That alone makes me prefer them over web browsers, no matter what their theoretical vulnerabilities may be.

I sympathise but find it quite contrary that you prefer to download standalone engines over something sandboxed in the browser. Although I believe there is some unknown percentage of users who won't turn on Javascript for this game, I can only imagine that a vanishingly small percentage of those might take a stance similar to yours.

The other obvious flip-side of your argument is: Javascript has a much bigger potential audience than IF engines these days. That alone makes Javascript preferable to develop for. The security and privacy issues do not make enough of a dent in Javascript's userbase to make this a serious consideration for developers.