Simply because blast radius for Java is limited to a set of very high quality libraries -- in terms of code not functionality. These libraries come from Apache Foundation, Eclipse Foundation, Google, Facebook, Spring, etc. Literally every single Java application depends on something from Apache [ok I understand stuff like Log4Shell can still happen].
The same is not true for JS. The most mature libraries depend on absurdly vague libraries that no one has ever reviewed.
The same is not true for JS. The most mature libraries depend on absurdly vague libraries that no one has ever reviewed.