The most benign explanation I can think of is to prevent an attacker from using social engineering where they give the victim a command to run in the JavaScript console.

Sites with a large number of inexperienced users (including children) have to think about these things.