There have been sufficient issues with libraries such as zlib and handling of various image formats. Running without js certainly reduces the attack surface substantially, but it’s not a full protection.
Yeah, image libraries is one of the reasons I disable images on all forums that I visit, apart from being tracked by random participants through image requests.