in regards to your second question: Why wouldn't you write components in a modern, generally well-sandboxed safe language? (Of course you shouldn't break the sandbox to do so, but using JS in general is not a bad thing)
I guess my (potentially old-school) thinking is that for something that needs to be a solid as a security layer, integrated with the OS, I would only consider memory and type-safe languages.
