So, I agree with everything the other responders are saying. Whitelist the primary domain (and maybe a cdn domain that is hopefully nicely labeled) and a decent site should play decently. But it is also that I (generally) know when to pick my battles--or I at least keep my pointless battles to a small scope and fairly sporatic.
I'm asking for a solution to this from the lemmy community, not reddit or a big corposite. They would want a single domain or a few domains for opposite reasons than making the user happy: they would want to control the user experience and ensh**tify via dark patterns. I do not think we should need to blanket allow scripts from dozens of sites just to see images, that's the scope of this mini-battle I do not plan to fight beyond this post. I mention ensh**tification because I just happened to see this https://thetyee.ca/Culture/2025/05/26/Internet-Sucks-Cory-Doctorow/ on this https://old.lemmy.world/?sort=Hot&listingType=All&page=3 (thanks, above suggester for reminding me of old.lemmy).
So open technology like the web is replete with disenshi**ifying add-ons. Ad blockers are running in more than half of all web browsers in the world. It's the most successful consumer boycott in human history, but there are zero ad blockers running in apps, because you have to reverse engineer the app first, and that's illegal under use of Bill C-11 and under the U.S. Digital Millennium Copyright Act, and Article 6, the copyright directive.
[Note, I censored those letters. I've been told you can swear on the internet, though.] One of my "old man yells at cloud" moments of late is when I have to deal with a very small company forcing an app down my throat when a website will do and the using of that company/service (and thus app) is being forced upon me by outside forces. If it's a small enough company, I will go through too many emails back and forth with their "CTO" telling them why it's a problem and why they should just have an app (a site that, yes, almost certainly would need javascript). Because that's the small act of protest some of us should be doing in my mind. That way the next time someone thinks, hmm, we could just do an app and only offer it, they'll then think, naw, there's going to be that one annoying customer, not worth it. Same with this issue, for me at least. I don't see why we /have/ to run javascript on secondary sites just to have a thumbnail and a resulting image. And I'm posing this, again, on lemmy not reddit. So, consider this my allowing myself a brief moment to yell at a cloud.
[EDIT: Escaped my asterisks. I worried there would be automatic markdown, but I didn't see the Preview button.]