Does this difference mean that the two language implementations need to solve fundamentally different problems, security-wise?
Are there attacks which are possible via untrusted code and data, but not via untrusted data only? If so, presumably a Python implementation can afford to ignore these types of attack, but a JS implementation would have to be secure against them?
Or should all attacks that are possible via untrusted code also be considered possible via just untrusted data? In which case Python implementations should employ as many security features as JS implementations?
In other words, is it a simpler task to secure a language implementation against malicious data only, compared to both malicious data and malicious code?