Comment by TBurette

The goal is to prevent any way for attackers to inject code.

Bookmarklets and user scripts are collateral damage.