I should add that there's a trade off between security and convenience. Tech savvy Tor users have asked for JavaScript to be disabled by default, but that would break 80% of clearnet sites. The unsavvy users would think that TorBrowser doesn't work and abandon it. The Tor devs believe that using Tor with JavaScript is better than not using Tor at all, so they distribute it with JavaScript enabled. It is safer to disable JavaScript, but I personally don't consider it a threat when doing a Google search or browsing Wikipedia, for example. I'd be more worried about obscure web sites.