It's on by default in Tor browser.

You have to explicitly switch to "Safest" mode to turn it off completely.

>Why does Tor Browser ship with JavaScript enabled?

We configure NoScript to allow JavaScript by default in Tor Browser because many websites will not work with JavaScript disabled. Most users would give up on Tor entirely if we disabled JavaScript by default because it would cause so many problems for them. Ultimately, we want to make Tor Browser as secure as possible while also making it usable for the majority of people, so for now, that means leaving JavaScript enabled by default.

https://support.torproject.org/tbb/tbb-34/

Yes, even without JS a website can tell what size your browser window is. One way would be to use a large amount of media queries like so:

    @media (min-width: 1000px) {
      #tester-1000 {
        background-image: url("1000.png");
      }
    }

You could also imagine a website first using ~15 queries to know what the window width is upto 100px, and then provide coarser media queries on the next page load.

Yes, CSS and <picture> etc. can load different resources based on viewport size. Then there are side channels like lazy loading, layout + what you interact with.