The v3 fixes this by instead only letting bad blocker submit things they want blocking, and never letting them see that page. It’s not perfect by any means, but it is much more secure.
For example, iOS runs content filters in a special isolated process with no persistence or access to the outside world.
With this model, the content filter requests elements to be removed and the browser does the actual removal. As such, the scope of modifications can be reduced whilst keeping arbitrary and perhaps complex filtering logic.
“Send it somewhere else” being the important part.
The interface Chrome went with was a declarative list of filters that Chrome will use to perform the actual filtering, but the declarative interface isn’t great and wasn’t well received.
My point is: there is an interface that is non-declarative and sandboxed, whilst allowing Chrome to perform the actual filtering.