I don't agree with you on (1), so I think we need data.

(2) is creating an entirely different argument from blue sky. You're putting words in my mouth.

I support installing ad-blockers to reduce attack surface.

Removing Flash and Java is more nuanced. Most non-advanced users expect Flash sites to work and many non-advanced users need Java sites to work (e.g. enterprise internal crap). I think click-to-play is a decent mitigation here that non-advanced users can understand.

Maybe disabling Java is okay, so long as they really do not need it for anything. Disabling Flash is a harder sell.