And that's only for the websites they know of.

If we know what bad javascript malware is out there and how to recognise it, then browsers could have an antivirus, to block the offending code? As an opt-out feature, not opt-in, where known actively malicious JS would be scanned for and removed. Presumably, a number of compromised websites were compromised once and attackers aren't going around updating all their malware in all their compromised servers as soon as they get blocked?

Then again, the web is getting so bloated already, even suggesting that we make everything slower in order to filter out the known harmful bloat makes me shudder