There is definitely a risk - scripting essentially allows execution of code on the browser. The vulnerabilities range from reading your browser's history to installing malware to phishing your bank credentials - each of which can potentially cause you "harm" in some way.
However, given that most of today's web sites rely on scripting, there's a huge loss in turning scripting off, up to and including the site no longer showing up in your browser. Turning off scripting also won't protect against other ways for bad things to happen to your computer, so the return for the inconvenience isn't incredibly high.
Probably the most common use of scripting is analytics, which allows the webmaster for that site to gain information about who is accessing which pages, thus potentially improving the flow of the site and the information presented. However, the flip side of analytics is targeted advertising, which allows advertisers to follow users across multiple sites.
The majority of scripts on websites are "mostly" harmless, just like the majority of software that's available is "mostly" harmless. Security folks focus on the malicious side of things, and continually re-learn that there's a trade-off between usability and security.
What I personally do is use Firefox with the add-ons NoScript and Ghostery. Between those two - NoScript especially - the chance of having scripts injected into the page I'm viewing is greatly reduced. I still expect to get pwned at some point, but the tools I have will do a reasonable job of keeping me aware of what's happening as long as I continue to pay attention.
Man-in-the-browser is the number one risk. I would say that enabling more efficient malware delivery is secondary.
Things like the Browser Exploitation Framework (BeEF) -- http://www.bindshell.net/tools/beef/ -- should provide a better explanation through its implementations.
If the usability goes to zero, people will find a way around your anti-scripting lock down. As mentioned before, NoScript is a really nice plug-in for allowing certain sites to run scripts.
Drive-by downloads are probably a much larger risk for unsophisticated users. You don't need any scripting to show the user a fake flash media player that says "upgrade required" and when the user clicks the fake "play button," it downloads malware that they install. Game over.
And flash has had a number of buffer overflows and vulnerabilities.