Javascript often is used to load such applets within a page and can also be used maliciously. Blocking both it and plugins unless you say yes is a good way to harden your browser against having vulnerabilities in the engine or plugins exploited, as is sandboxing.
