Your quarrel is not with JavaScript (as everyone else has pointed out, there’s no reason one can’t build a secure compile-time type system on top of JavaScript), but with some of the specific design decisions made by TypeScript that open soundness holes, such as “programmers are too stupid to understand the difference between covariance and contravariance, so we’ll pretend everything is bivariant”.
See https://www.typescriptlang.org/docs/handbook/type-compatibil... for a less cynical presentation of these design decisions.