The opinionated approach feels restrictive to me. My best recommendation to avoid slowness, privacy violations, and other nasty things is to not include certain features as opposed to eliminating JavaScript.

For example if we know large SPA frameworks and/or slow websites require use of convention A then simply not include support for convention A. This is a fail by design approach instead of a blacklist approach.

Here are some things to block to radically increase performance:

* string parsing: innerHTML, querySelectors, console.log

* allow a quota of load time requests and then stop taking http requests until a person interacts with the page (or just break the page). If you set the quota at 10 then any pages with greater numbers of requests will just stop loading. That alone will eliminate 99% of spyware and dramatically shift user behavior.

* drop requests for JavaScript from different origins than the page will improve both performance and privacy

The biggest thing to help with privacy is to not support CORS. That will do more than eliminating JavaScript.

These things are still highly restrictive but much less so than a blacklist approach.