With some effort javascript from known sites could be fingerprinted and vetted.
An unexpected change could trigger a warning and blocking.
But with WASM we are really in trouble.