Well, you've answered your own question: it is a security issue. Browser implementations of JS sort-of sandboxes JS. You can interact with the browser, you can request the browser to do certain things (like JS has access to the DOM via an API in browser implementations), but you can't just go ahead and do things.
Not only because of security limitations, but also in part because JS, left to its own devices, has no IO capabilities.
So, basically: JS lacks IO capabilities, and browsers don't provide an IO API that allows scripts to access the client's local file-system. And thank Christ for that, if such an API would have been available, browsing the web would be as risky a thing to do as... trying to teach lions to read in a nuclear reactor, while covered in hot-sauce or something...