Windows Defender has no web filter, these scripts you take them on torrents websites, online movie sites, most of them coming from malicious advertisements.
WD on default settings has disabled web protection, but
it can be activated via PowerShell or Configure Defender tool (on Windows 10).
Furthermore, there exists the browser extension (Windows Defender Browser Protection) for Google Chrome. Edge has SmartScreen which is pretty good.
Yet, the above protections (
except first) rely on webpage blocking - they do not block malicious scripts, but the malicious webpage links.
Most people use the popular & free ad blocker extensions to block malicious advertisements (AdGuard, uBlock). But, I did not see the test about how effective they can be against JS/Adware.Agent.AA infections.