The sole criterion for JavaScript was to design something that could be shipped as fast as possible. The early browser wars were all about pumping features out. Security had nothing to do with it.