Anything you do like this to "customize" the default Tor Browser install can reduce your privacy instead, as it provides a factor by which you can be fingerprinted and differentiated from the larger base of users using the Tor Browser as-is.

Source: see the Tor Browser docs on why they enable JS by default (though NoScript is installed and can be configured to block all JS, if you know the risks) https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...

There are any number of ways to deanonymize users once javascript is running, not to mention the greater possibility of escaping the sandbox. It's a damned if you do, damned if you don't scenario.

I know they're trying to serve users that can't be expected to play the whitelisting game, but they really should be stricter here. It's already trivial to differentiate a Tor user from a regular one, they might as well set the most secure defaults possible.