Your second one is why I came up with the phrase:
Java is to JavaScript as Ham is to Hamburger.
That said, your third one is TRUE for client side processing, as any script in the browser can screw with damned near anything you do. Hence why sending ANYTHING security related client side for processing is stuffing the herp into that derp, in a full on ermagerhd way.
See the number of times I've worked for clients who's shopping carts got hacked because the nitwits were calculating the costs and sums client side, instead of not trusting what the JavaScript was doing since what's that rule? ALL client side processing is suspect and should be double-checked server-side!
Well that and the classic:
If you can't make a fully functioning and working website without JavaScript FIRST, you likely have zero business adding JavaScript to it!