Right. What you can sometimes do is observe the effects of the content being loaded, e.g. see the dimensions of an image element change when its content is loaded.
Is there some document somewhere that lists all the potential ways of doing stuff like this?
Yeah, https://xsleaks.dev tracks most of the known ways to leak cross-origin data.
oh hell yes. And oh yes iframes and postmessages, of course people would setup them incorrectly and even if they do some (probably not that important but still) data will leak if you're creative enough. Thanks for the link!