If Javascript were compiled into machine code before being sent to the client, it would be exactly 0% more useful for security related purposes.
Wrong; machine code is much harder to reverse-engineer than source code or minified code. Not impossible by any means, but it raises the bar; security-through-obscurity really does work, and is better than nothing at all, though it's obviously not something to be relied on if you can help it.
You're right, I should clarify. If Javascript were compiled into machine code before being sent to the client, it would be even worse for security most of the time, because a false sense of security (source code obfuscation in this case) is often worse than none at all. It lulls people into making bad choices that they may not have otherwise made... "Hey, nobody will ever figure out my Javascript code, therefore I can cut my workload in half by only doing the client side validation and skipping the server side validation! Great!", or "Hey, since nobody can read my Javascript, I'll just send down the whole database with every request, it'll be so much faster that way!"
I would also point out that in this particular case, reading the Javascript (regardless of how easy or difficult that is) is rarely going to be the preferred way of exploiting the system when you could simply peek at the network stream and see what happens when you push buttons.
In actuality, Javascript (ran in the client's browser) is far from useless for anything security related. Say you're implementing a login page. The naive approach would be to have a login and password field and send that over the wire back to the server in plain text.
Ok, I guess we need to start defining what we mean by "security". What you're describing is a situation in which the server implicitly trusts the client, but doesn't trust anyone that may be in the middle snooping on the communication. What I was talking about in the context of this copy-protection stuff is a situation where the server does not trust the client, and wants to limit how the client uses information the server sends it.
No, I'm describing a situation where the server does not need to trust the client and the client does not need to trust the server (in the ideal case). The client *proves* itself every step of the way and visa versa. It should go without saying that the actual format of the data still needs to be rigorously validated after it is received and before it is used.
The only way to limit the way the client uses information you send it is to limit the information that you send it.
* I was looking at free shopping cart software a while ago and found one that was implemented entirely in Javascript. It was fast as hell of course, and very nice-looking, but the problem was that, being Javascript, it was trivial for anyone to make up any order they wanted and send it to your server. You'd either have to implement a bunch of logic on the server to make sure your orders are legitimate, or be sure to catch them manually (easy if your volume is extremely low, not if it's higher). The whole thing just looked like a bad idea because it was trusting the client so much.
You have to implement a bunch of logic on the server to validate the order no matter how you send it to the server. Whether you construct the shopping cart one item at a time (dumb page with a bunch of buttons that all do separate posts) or all at once (fancy Javascript page) matters very little if at all with regards to the complexity of validating the order as a whole. The reason why it doesn't matter is that regardless of how you hope the data gets to your server (users clicking buttons on your page in a browser), it can also come from sources you may not be hoping for (nefarious users constructing their own requests directly).
What does impact the complexity of the validation is the design of the data that you choose to send back to the server from the client. You could, for example, send back the product name and the price. This would be monumentally stupid, but I'm sure someone somewhere does it. At this point you need to match the product name to the correct product in your database so you can pull out the rest of the details for it, and then you also need to validate that the price that was sent matches the price that you have stored. God help you if you ever decide to update the name of a product, or use an abbreviation of the product name, or offer your site in more than one language, or ever change the price of a product, or dozens of other factors, and that's not even touching upon the issue of validating the freeform text for further use (embedded nulls, unicode, lookalike characters, typos, escaping, encoding, etc). If you were smart, you would send the product id only, which is probably a positive integer and thus extremely easy to validate and never needs to change, look up the rest of the details in the database and you're done.