True, but at least the attack surface area will have been reduced by a large amount which is worth something. Disabling Javascript served over HTTP is such a g

True, but at least the attack surface area will have been reduced by a large amount which is worth something. Disabling Javascript served over HTTP is such a good security improvement that I'm surprised no browser vendor has implemented yet, in the age of Let's Encrypt. It'll break a lot of websites, but better than compromised routers and ISPs serving JS malware.