Consider the whole web hostile. Browse with uBlock Origin and JS off. Enable JS for trusted domains only. Give up, blacklist, and go elsewhere if whack-a-mole enabling needs too many unknown random domains enabled just to read that article.
That has been the model since the beginning. The problem is that web developers and browser developers have a greater interest in doing their thing than in protecting end users. Thus the introduction of cookies, javascript, iframes, etc. It's been a continuous curve of increased scope inside tbe browser. Now we have web assembly, workers, websockets, local storage, etc. and no good way for the end user to actually observe any of this shit. Browser developers are reinventing the operating system, but poorly.
That browsers don't implement any effective autoplay control still is idiotic (but then, the solution is simple: deactivate all codecs, and use youtube-dl for a better and ad-free user experience anyway).
It's not that nobody's interested - people I know are interested in finding out how my browser is able to display pages so much faster than theirs, and how my computer remains responsive even when I have a bazillion tabs open. But effectively using NoScript inevitably requires having at least enough technical knowledge to understand how JavaScript works and predict which blocked components are causing the bit of the page that you actually want to fail to load.
It's almost like there needs to be a NoScript-like plugin that crowdsources a whitelist of domains (or, maybe better yet, specific scripts) so that non-technical users can have access to the knowledge of people who have the ability to figure this mess out. But, of course, you'd need to figure out a crowdsourcing method that's resistant to attack, because the ad networks and other malicious players would immediately be paying the click farmers to vote their scripts into the whitelist.
I don't think trying to convey what ad or script blocking choices they should be making really works with non-tech folks any more. To be fair it was always a bit of a stretch...
[0] https://chrome.google.com/webstore/detail/scriptsafe/oiigbmn...
Also has a "don't filter on this domain" switch for things like bank sites and other fragile ops.
It also allows blocking webworkers which mining sites tend to rely on.