> it’s clear that straight-out blocking HTML attachments with JavaScript is not an option for most organizations, as it would impact important business communication.

I suppose it depends on what your job is. My habit of decades for personal email is to not allow HTML at all. I do the same in the office. Sometimes, this means I'm reading the HTML source directly to get the information, which is inconvenient, but it's worth it to me.

Fortunately, most important emails I get contain no HTML at all, or use only trivial HTML that doesn't hinder reading the source.

I do wish people wouldn't use HTML in emails at all (it rarely adds anything useful to the email), but that's not the world I live in.