I agree it's not a good idea in general; it's presence here is merely to show the breadth what is considered "unsafe". Simply put, I didn't want to convey the idea that attributes alone can be unsafe. I could possibly move the inline event attribute to the portion of the article that discusses malicious code being injected via remote services.