To be safe one should disable JavaScript and most if not all third-party requests on .onion sites. Thats why TorBrowser always includes NoScript. Unfortunately

To be safe one should disable JavaScript and most if not all third-party requests on .onion sites. Thats why TorBrowser always includes NoScript. Unfortunately in an unsafe default configuration that allows too much. So overall, I guess this move isn't intended to protect the masses but provide more cover traffic mainly.