Good summary, 100% agree with all of this. And I'd add that the friction of switching to allowlist/denylist, at least for new projects, is very low, because the terms are obvious on their face. Once you've seen them once you know what they mean.