So, speaking as one of those fucktards[1], the idea that two third parties could possibly create interactive content without the participation of a standards body in the middle was a pretty neat idea. The 'pure render view' which was most commonly espoused early in the debate had the challenge that going from idea, to something people could use, took 6 months at a minimum and a year typically.
Since you were there you no doubt experienced the amazingly slow progress of support in HTML as it got pushed out to the #1 source of browsers (AOL) on a very slow timeline. The period between 1993 (can't use tables in your web pages because no one except XMosaic users have them) to early 1995 where "most" but certainly not a preponderance of web browsers supported them.
Some level of programability between client and server was essential. Had the 'render only' view prevailed you wouldn't have Javascript either. But it didn't prevail.
That said, security has always had a sort of anti-thetical relationship with 'features.' Its easy to sell features and its hard to sell security. I had built the basics for a nice capabilities based security model for Java early on (even patented it with the NSA's approval), which created a durable way giving only specific capabilities to an applet in a way that made other capabilities not only not accessible but not even present in the running system.
It was a bit more complex than the way class loading had traditionally been envisioned, it really crushed my motivation when another engineer on the Java project deleted it out of the source tree because he couldn't understand it.
The point I make is that these things evolve, and the story is never as simple as it looked like once you've gotten to the end of it. Should I have pushed harder on conceptual security even though it was hurting my career? Probably. Would it change where we are today? Hard to say.
[1] http://www.greatcircle.com/firewalls/mhonarc/firewalls.19950...