JavaScript security question

I second what said Os, I think the agency want to cover itself from any kind of trouble... Most of them could be for instability or page crash or runs infinite loop, or an external call for a malicious script, ... have a look at this old but interesting article https://www.algoworks.com/blog/security-concerns-with-javascript-development/

You're using a content management system?  If yes, then the agency who built your CMS is responsible for keeping it operational and free from spurious code that you may unknowingly introduce.  If they give you access to add more code, that opens up a Pandora's box of potential mayhem.  I prefer to lock down my sites because clients with code access have been known to do some incredibly stupid things. The less code clients have access to, the better.

If you need a carousel, etc..., a better compromise is to ask your agency to add the latest Bootstrap & jQuery libraries to your site's source code so you can invoke them with pre-built Bootstrap classes.

Having worked in an agency myself, I can tell you this sounds more controlling as most clients like some level of control, but usually adding scripting is reserved for the agency unless the company has a resource that knows what they are doing.  As websites should be always evolving with the needs of the business, I would suggest your best course of action is to leave the contract as is and review with your management when they are up for renewal and discuss potential changes to the existing terms or to consider other agencies if they are too restricting in their contract terms.

Javscript doesnt present a security risk if it isnt used for communicating to a database as in a Node.js workflow. Adding Javascript to a page could cause the javascript, which is currently present, to stop working due to a conflict between the 2 scripts, therefore the page would not function. I guess they are just covering themsleves for any errors which might result if code is introduced into the website, which they didnt create.

For instance you might include a jQuery library version which conflicts with the jQuery library they have used, if indeed they have used any jQuery.