> yes, i use programs/apps, but attack surface and threat models aren't binary, so it's still better to make things more secure

But again, the point is that market decisions aren't microeconomic. The world where everyone uses noscript by default is a world where no one builds web apps anymore (because the platform sucks by default) and everyone uses native apps from whoever the dominant vendor happens to be. And that's worse (much worse, by basically every metric, including privacy and security) and not better.

Your logic only works if you're a parasite: you can use noscript to "protect" yourself only if most people don't.