Potentially implementation related: The safemode=1 URL parameter "temporarily deactivate(s) all on-wiki scripts at once"

From a security prespective, the main risk (that a per-user off switch could address) is that these features allow making an xss "permenant" (excluding the risk of malicious admin). An option by itself wouldnt prevent that as a malicious person could just turn it back on. Would need to make the user do something like reenter password before reenabling

In T177895#3674239, @Bawolff wrote:

From a security prespective, the main risk (that a per-user off switch could address) is that these features allow making an xss "permenant" (excluding the risk of malicious admin). An option by itself wouldnt prevent that as a malicious person could just turn it back on. Would need to make the user do something like reenter password before reenabling

Err nevermind i misread that as special:mypage/common.js

From a security prespective its unclear how useful this is since there are other sources than mediawiki:common.js of javascript a malicious admin can target