All of the above are worth considering, but to be fair, there are well-accepted development practices as well as built-in protections in modern browsers that protect against the most severe cases noted.
It's also worth noting that there are three ways that third-party code can run in the context (that is, sharing the same browser DOM) as your web pages: 1) JS that you include and render along with your page, e.g. Google Analytics, or 2) Bookmarklets that the user controls (e.g. Spritzlet or Pinterest), and 3) browser extensions or toolbars. The latter two are almost completely out of your control; the first is something you can audit to some degree.
By far the most important thing to ensure is that the web servers you do control that serve and respond to the client (browser, bot, malware) are locked down. XSS, CSRF, SQL Injection and multiple other attack vectors are within your control on the server side. You would have to explicitly allow CORS on your server side, but if you do, make sure you know what you're doing, and be particularly vigilant. This is not to say this stuff is all easy or obvious or anything, but it's entirely independent of whether it the vulnerability is breached via JS or any other method.
Assuming you have protected your web server and locked down the endpoints that can be called, the rest of what goes wrong falls into a different class. JS (and plugins/extensions/toolbars/bookmarklets) can do a wide range of bad things -- keystroke loggers, injection of harmless looking elements that actually send data elsewhere, and so on. All of these are executed by the browser.
If you're serving the JS on behalf of a third party, you should be careful to trust and verify the source. A Google Analytics snippet is probably safe. A third-party ad-serving widget might be worth looking into more carefully. In all cases, the code behind these can be inspected: if the browser can run it, you can see the JS code and decide: is this something you want on your site?
There's little to nothing your site can do that allows JS to arbitrarily execute code on a the user's computer -- it is the user that must have recent updates to browsers and OS, etc. You could detect old versions and post warnings to be a nice guy, but that's about it.
Secure your server, install updates, make sure your code is safe, avoid serving JS from unknown third parties. And then, make sure your site is registered with Google Webmaster Tools which will notify you if your site is hacked in many cases, and if you can afford it, get a service that scans your site for vulnerabilities.