Nope, you've just applied your application model of the web to the web as a whole. Most websites are not actually applications and the risk of "injected content" to people with javascript turned off is very, very low.

The risk comes from the absolutely bonkers corporate/institutional use cases of automatically executing all random unverified programs sent to you. When you remove this crazy use case suddenly all the problems (and bonkers requirements) go away.

Seeing a goatse is not the end of the world and actual MITM injection attacks like you describe are rather rare now. I miss when wifi use to be open and that issue mattered.