User-provided Javascript?! Who decided this would be a good idea?

In this thread, if you hover your mouse over the first comment (of the OP, who is suggesting that you do so), a popup alert opens giving you a greeting from the OP. The alert is modal (meaning in order to go back to using the page, you have to actively dismiss the alert, for example by clicking "OK").

What exactly is going on here? It seems like chess.com has given users the ability to put Javascript onto pages? First of all, depending upon how it's implemented, that could be an incredibly serious security issue. Browser hacking, malware downloads, that sort of thing -- all of that can be done via Javascript. But even if steps were taken to try to prevent that, it's still at best just a chess.com coder's small oversight away from being one.

And even if it's somehow magically guaranteed to not be a security issue... now I'm going to be interrupted by modal popups whenever some script kiddie thinks it would be cool?

I hope I'm misunderstanding this.