Maybe 15 years ago I found a homenode exploiting the ability to add JavaScript to do some nasty things. I can't remember exactly what happened as a result but my gut tells me that this was when the option for scrubbing 'risky' things from homenodes by default was set.

I see a switch "Disable some JavaScript on homenodes

That one doesn't affect it but the next one does - Don't filter risky HTML from monks' homenodes - however, this has to be set by people viewing the home node so it doesn't really help. It is there to turn off unwanted JavaScript in other monks' home nodes but it's picking up my non-JavaScript module name!