[_Algernon_]

The fundamental "transaction" of the web is that the client requests files from a server one behalf of the user. The server can deny that request on behalf of the business by for example returning an 403 access denied error.

If the server returns a file, the user hasn't implicitly agreed to some limited use of that file or that it must be processed in some specific way, but the business has implicitly agreed to the user's usage of that file. The user (or the client on behalf of that user) can choose to ignore that file, not execute it or not even request it in the first place. This can be done either manually or assisted by tools (e.g. sponsorblock, ublock origin).

Anything else puts arbitrary restrictions on the weaker party (individual vs. large business), and negates their property rights of being allowed to choose what runs on their general computing device. If the business doesn't want a file to be used, don't serve it in the first place.