How can I disable JavaScript in Drupal themes or Drupal itself?
Javascript in and of itself is not the problem. I'd place more energy into ensuring that your Rich Textareas  (body, comments, etc) and permissions are configured properly. This is one area where people can slip in rouge JavaScript which may be run on other visitor's browsers. Use TLS (Https) by default and use modules that aid in security such as Security Review, Secure Pages or Secure Login help secure the login process. 

There is also tons of great advice and direction on line:


10 Simple steps to protect your Drupal site 
Configuring text formats (aka input formats) for security
Securing file permissions and ownership