[rtpg]

But the issue of preventing arbitrary Javascript code from running based on user input isn't limited to Angular, it's a problem since the beginning of time!

What about Angular is so special that it needs to be blacklisted? It will likely still be safer than ad-hoc client-side templating that people will do instead.