rob006 There will always be a trade off for security and privacy. I deal with these kinds of issues daily at work when planning out new security measures. Things like if we encrypt all of USB drives it protects our data from being stolen by accidental loss of the USB drive. But if we do that then we can't use our USB drives on any computer that isn't connected to Active Directory network. If we enable MFA it greatly decreases our risk of phishing attempts being successful, but at the cost of time, training and potentially breaking important internal applications. So forth and so on, every action has a risk, every security/privacy measure has an impact on usability. If you wanted to be truly secure you would isolate your computer entirely, use an operating system you built yourself, never connect to the internet, keep it in a faraday cage and never connect it to anything but batteries. But at the cost of an entirely unusable computer.
Also even without JS you can still be vulnerable to attack, all it takes is someone making a discovery about the way the browser handles HTTP headers, URLs, CSS, fonts or HTML or anything else and using just the server logs with a little Machine Learning someone can learn a lot about you and your browsing habits. I understand your security concerns and privacy concerns I really do, however you have to question if being unable to use a lot of websites properly is worth the tiny bit of extra security you gain.
