@dalias @pkw You can, but that is only because HTML in most browsers has too much access.

The less functional access one gives on a machine, the less attack surface is reachable.

One doesn't need turing completeness to expose too much attack surface. However turing completeness makes it a hell of a lot easier to expose too much surface though, and facilitates nuisances like denial of service & resource exhaustion (still readily feasible without turing completeness).