Recently we encountered problems with adwares being accidently added by users to course sections, forum topics and places where javascript is allowed.
After following moodle docs, I enabled Site policies -> Enable trusted content (enabletrusttext) in order to make the capability 'trustcontent' active. I tried to disable the capability for other Teacher role but yet it was able to post and execute JS.