Surely the problem isn’t making changes to a page, but instead having access to the full page content and being able to send it somewhere else.

For example, iOS runs content filters in a special isolated process with no persistence or access to the outside world.

With this model, the content filter requests elements to be removed and the browser does the actual removal. As such, the scope of modifications can be reduced whilst keeping arbitrary and perhaps complex filtering logic.