What you said is true, but the Tor devs also tell people that they should leave javascript on because if they turn it off they will stick out from everybody who used the default settings. If you are mostly concerned with browser fingerprinting leading to linkability then this is good advice, if you are mostly concerned about somebody hacking you then it is bad advice. They assume that everybody is concerned primarily with linkability.