This is unfortunate. On all my phones, I find the most annoying malware is spread via javascript. I'll get onto a page I read a few times a day, and suddenly, thanks to ads, I am served some javascript malware that attempts to tell me "my PC is infected" or other such garbage.
I grouse, turn off javascript, clean my caches, and then everything is copacetic for a bit.
If this means that, thanks to google's decision, that I must in no uncertain terms, have javascript on in order to interact with their product line, then I need to weigh risks and benefits. Not proclaim loudly that I will run away from the google ecosystem, as many are likely proclaiming in this forum.
But weigh the risks of using products which require me to be vulnerable to attacks, versus alternatives.
From the viewpoint of google, you don't want your customer to ever be in that position. As it is an arms race against bad actors, and forcing users to effectively lower their defensive posture means you really ... REALLY ... need to up your game on value for this to be even net neutral relative to previous state.
Given how completely horrendous google's customer support is, and how incredibly hard it is to administer basic stuff (it took me more than 1/2 hour! to search and find out how to close an unused business g-suite account, which I couldn't do, until I manually disconnected from a marketplace product ... where this disconnection was also hidden ... google doesn't do ux/ui worth a crap, and has no real support for smaller users), I am not sure this is in their best interests. I am sure there is a product manager trying to pull them back from this ... somewhere ...
Or at least I hope so.
Basically the risk calculation is when where you look at something holistically. Is using the google universe worth the risk that universe forces you to accept?
Part of the reason that facebook is in user count freefall, is this inherent risk. You are volunteering info that advertisers are dying to get, and they are the ones paying facebook. You are a packaged product, you can be microtargeted, and various bits of self-serving posturing over election non-interference and account termination aside, they haven't quite grasped that this intimate relationship brings substantial risk for participants.
I've dropped messenger from my phone, and am about a few months away from dropping facebook from the phone. I don't need it there, and the risk to me is far higher than the "value" it brings.
Back to google. You don't want customers thinking this. You want them happily and securely playing in your garden. You don't want to force them to go out without their armor. Turning off javascript strengthens that armor. Forcing it on strips users of their most important armor.
Put more simply, bad google, bad.