JavaScript tends to be fine in specific allow-listed circumstances:

  * User preference (E.G. plugins/extensions)
  * Native to the site, when a user is logged in
  * Trivial and sandboxed to page local data

I recall how I used to use Flash, with a plugin that delayed the loading until AFTER I hit 'play' on the plugin frame.

I suspect that's the sort of security framework that will solve a lot of the problems. Do not run untrusted code by default. Have the user to enable a site (often during account creation / sign in on a new device). Have the user 'click play' if they expect something to work.

Make sites that just work without client side code again.