The Tor devs think it is better to blend into the crowd of browser fingerprints that have javascript enabled than it is to protect yourself from javascript based browser attacks. There is a trade off for sure, but I personally choose to avoid using javascript. They also want it to be enabled by default because a lot of Tor users actually want javascript and don't know they want it and don't know how to turn it on. So if it is off in TBB they will just stop using Tor. Also please remove your CP avatar the vast majority of people here have no desire to see babies being raped.