Blocking all scripts breaks modern web functionality and shifts the attack surface to document macros and offline execution vectors that standard policies often ignore.
Trojans bypass security by hiding inside trusted programs, meaning your antivirus often sees only the clean wrapper and ignores the hidden payload inside.
