Yeah but if it’s just pure HTML you got an ugly-ass website that’s annoying to use. There’s been many JavaScript and css vulnerabilities over the years of course. But yes there was and still is plain HTML issues

Client side:

• I vaguely remember some base64 embedded encoding malware.
• I do believe there was some issues with early HTML, if you had malformed tags, that could bypass checks and balances.
• Svg, Images, audio, fonts, and video can definitely contain malware. Before you say fonts are a css thing, <font> was a real tag
• IFrames were the worst:
  • They had too much power in the past and could hijack the page and browser.
  • There was no content security policy back then so they could inject JavaScript into the main page as well.
  • Also they can cover the whole screen and present a normal login screen, and hijack all inputs going through it. Think of it like you’re on dodgey-site.com and it has a full page IFrame to bank.com. This was a common hack back in the day which inspired an entire http header to help prevent this.
• Anchor tags can link to something dodgey of course.
• Embedded PDFs were a huge issue.
• ActiveX and other web applets was just fucked. They were so bad they caused malware constantly. This is where unsolicited toolbars came from.
• Adobe Flash had many many vulnerabilities over the years.
• Canvas bugs are still a thing today.

Server side, you could execute SQL injection and path traversal just via URL before the page even loads. Malware and other issues can be embedded in text inputs. HTML can be uploaded to the server and in some cases replayed on the page affecting other users (comment sections were infamous for this).

So yeah; a plain HTML page with no JavaScript or css isn’t necessarily safe