There may be genuine use cases to run a script, or whatever the attacker used. The problem is the browsers will auto-run stuff, the user isn’t aware and there’s no way to stop it. All unlock does is provide the missing security layer called “don’t auto run shit from the web”.