It's also true. Even at the most benign level, non-free software exists to coerce you into running unverifiable code on a machine you own. Less benign non-free software coerces you into paying for a license, signing an EULA, participating in a botnet, etc.
You can still track users just fine without Flash - the VPAID spec calls for allowing cross-domain "Friendly" scripting access, which is horrible for users.[1]
The only problem with Javascript adoption was the availability of Javascript based ads and support for this VPAID style tracking.