You're very close to understanding something.
(Though in defense of DOM purifiers they can use a whitelist)