[notepad0x90]

couldn't agree more, I do malware analysis too but like you said only as needed and to understand its capability (more Jscript than JS to be honest, except with the rare node malware). Obfuscation has always been a method of slowing down and discouraging analysis, not preventing it entirely. If it takes a week for a dedicated analyst to reverse it enough to clone the capability, and you do two week release sprints, that might be good enough.