The website usually includes the address of the content to display or script to run. My post meant that I don't think we should take it as a given that our browser must fetch and run all of those resources automatically or else violate some protocol.

And if a user wants to have a policy of selectively choosing what content they want, but that content is hard to define or whitelist, then using a blacklist mechanism doesn't mean that the policy is to block. It's just the most common, practical method of choosing the content you want.