If browsers restricted cross-origin sharing of image resources to same domain only, bazillions of dollars in tracking pixel revenue would evaporate.
Deep inspection of image rasters by script execution isn't going to get locked down anytime soon, I surmise.
However, I would quite like cross-origin blocking of things like flash and scripts. After all, that flash program that kicked the whole thing off probably wasn't loaded from the host web site. That seems much more sensible and low-impact to me. It also has a side-benefit of forcing ad networks to fall back to static images, which has to be a good thing.
Because I think that's the standard. If they can do it for Flash, then they can do it for anything else, too. They just need to set a deadline with a reasonable amount of time before it's reached so that all developers can adhere to the new specs.
I really hate the attitude of "well, too many websites/apps would be broken so I guess we'll never do it, or we'll just wait for the web to collapse first so that everyone agrees we should do it" from "platform" (in this case browser) vendors.
If it's that bad, then just set a 2 year, 3 year, or even 5 year deadline for the change (perhaps with some intermediary progressive blocking, like it's happening for Flash).
It pisses me off because it seems the same is happening with ASLR on Linux [1]. We've had it for 15 years, but nobody is willing to force developers to use it "because it would break things". Screw that. Set a deadline and do it already. If their apps can't make such a change in 3 years, then I could care less that their apps will stop working. Critical vulnerabilities that allow dangerous exploits to happen also "break a lot of things", and not just themselves either, but the firefighting patches that come after them, too.
I've been highly irritated by people freaking out that Flash is started to get blocked - despite it being deprecated in those browsers for years. It wasn't exactly a surprise.
But I guess that's the crap that hits us. No one will make a damned change till they're forced to do it right now.
I'm somewhat sick of advertising networks serving malware. JavaScript is Turing Complete, and leaky as hell. There is no safe way to use it for ads, so don't let you clients use it!
The modern web relying on huge megabytes worth of data has led to us needing CDNs and other 3rd party providers.
Anytime a websites uses a 3rd party provider, it opens a hole in itself, and with the insane complexity of a modern browser... That's just asking for trouble.
But asking Google to give up the practices they use to forward their own agendas, like advertising, and their walled garden of AMP, won't happen.
Chrome has the usage that it can exhibit considerable force on the other browsers, and the reverse isn't true.
EDIT: In other words, I completely agree with you, but cry when I see that state of things. Just want that to be clear.