As far as I've seen, every browser I use have a long
User-Agent HTTP header that is as detailed as that it contains specific browser versions (or can be used to accurately deduce browser version, sometimes a little more about the host environment).
Assume there's an either known or 0-day vulnerability of some specific environments that allows a web page to do something wacky, a web server could easily do so by checking the user agent string and send malicious code to only vulnerable clients.
I doubt it's hard to think of other exploits where the UA string plays an important role.
Given that, why would an average browser still send this information to whatever website you visit?