But even worse than that, because you have a limit on how big that list can be. Otoh, with full permissions it can still do things like hide ads that aren't bl

But even worse than that, because you have a limit on how big that list can be. Otoh, with full permissions it can still do things like hide ads that aren't blocked by the declaritive rules. But, to continue the analogy, that's like killing a process after it's doing malicious stuff instead of preventing it from running in the first place.