Basically everything is a security threat one way or another.

If you want other people to do things for you, it's a potential vulnerability, so if you don't want that, don't let people do things for you. But then don't complain that they aren't doing things.

Disabling JavaScript is a tradeoff, you trade off its conveniences for security and resource usage. But you can't have your cake and eat it too.