Failure of sandboxing

You are right, but if there's one lesson of security failures, it's that you need to fix all the lines of defence. The web browser shouldn't launch an external program such as Yelp without user intervention. Yelp shouldn't let the help file pass through a <script> element verbatim to the final HTML. Even if <script> or <svg:script> does appear, the JavaScript engine should be fussier about whether to run it. Even if it does run, perhaps the JavaScript engine shouldn't grant network access or local filesystem access by default. And even if all those steps fail, the yelp binary itself should run in some kind of sandbox that forbids it access to ~/.ssh or the network without explicit user approval. (That last step applies to many small programs, as you noted.)