doesn't require allowing javascript of a million other servers?
half the images are broken because I’m expected to allow scripts on like 30+ sites to see most of the posts
software like noscript is not exactly beginner friendly. you're expected to understand the impact of your blocking and what you are blocking. the only domain you need to allow JS from on lemmy.world is lemmy.world. standard lemmy-ui does not load any js or css from third party sources, only the domain where lemmy-ui is served. your noscript configuration is blocking the actual images, not javascript that would be required to load images.
edit:
to expand on this, even in tor browser in safest mode, lemmy.world works totally fine when all you do is allow JS from lemmy.world on lemmy.world:
nothing about this is cherry-picking. it's simply how lemmy works. there are no remote js sources. lemmy-ui even sets security headers that prevent loading js from third party domains.