Tor Project ships TorBrowser with JavaScript enabled not because they don't care about traceability or people getting hacked, but because disabling JavaScript would break a lot of clearnet sites, and most Tor users wouldn't know that they can whitelist domains or turn off NoScript. They would think that TorBrowser is broken and stop using it. The Tor devs surmise that using Tor with JavaScript is better than not using Tor at all. That being said, the Tor devs put NoScript in TorBrowser and it's easy to turn on if you're worried about JavaScript attacks.