It ... ultimately doesn't scale. The black-hat namespaces are too large, and treating as TOFU eventually proves untenable.
Advanced features -- anything beyond rendering basic HTML, and I'd be quite prepared to argue for a very limited subset of that -- should be expressly prohibited unless enabled.
The trick is to make enabling reasonably painless and consequence-free (e.g., enable into a sandbox). There are still the problems of users gratuitously enabling anything and everything (especially when prompted through website notifications, pop-ups, phishing and vishing social engineering attacks, etc.), as well as the problem of largely invisible second and higher-order effects.
But the key is to cut down on the effectiveness of such methods, to impose costs on websites for employing them, and to make black-hat attacks through these too expensive by reducing the herd susceptibility to the attacks (the unbocking would have to occur on a one-at-a-time case-by-case basis, e.g., it's expensive and has limited scalability).
I don't think we'll actually see this for another 5-10 years (my usual sane-suggestion take-up lead time, it seems), but It Would Certainly Be Nice To See.
I had experimented with NoScript long ago, but found it a bit more cumbersome at that point because (then, before the uBlock days) I couldn’t really judge which scripts were necessary and which weren’t. I’m going to try it again.
One big plus with disabling JS is that all those ad blocker blockers and other annoying popups just don’t even appear, and that adds to a better experience.
I have JS blocked on some domains because of popups/other annoyances which make getting to the content a hassle. In those cases it's the exact opposite.