Your code on the client side is merely a convenience for malicious advertisement code if accessible. How your client side code interacts with the server is what matters and the malicious code can do whatever your code can do with same privileges if you are including it on your page.

If you are running untrusted code in JS then real private methods have only given you a very false sense of security. You should have run it in a sandboxed process instead.