@oblomov @jwz Because we can implement XSLT in JavaScript but not the other way around. JavaScript has many, many, many issues, but it's a pretty good example of the "airplane rule" in terms of being the "one really good basket we keep all our eggs in" for security-sandbox purposes.
(Personally, I'd be 100% in favor of maintaining the XSLT APIs but under-the-hood implementing them in JavaScript, though that would still need security consideration since they'd likely be running in privileged context that has access to more state than regular in-page JavaScript. Possibly not necessary; I'm not familiar enough with the XSLT spec to guess off the top of my head).