I’m not security expert but seems to me if you clicked on something malicious, it costs you nothing as you’re not really exposing anything. Obviously don’t do your banking, etc on the same VM then go clicking around warez sites
VMs are another reasonable approach. I don't do that, though, because it's more hassle than it's worth to me.
> if you clicked on something malicious
That's not my primary concern. My primary concern is really to stop bad behavior that is very common across all websites (tracking, etc.)
you can get the add-on for Firefox mobile also. It can be a hassle for the lazy user, but the addon will provide visibility into scripts, cookies and services used by websites.
Most scripts are blocked by default which dramatically improves page load times and privacy.
At least I can firewall apps to mitigate any abuse they may engage in. That's much harder to do with websites.