> I use Pale Moon which doesn't have "click to play"

It did (in about:config only), but apparently it keeps getting broken in recent versions, so people have resorted to extensions like FlashBlock. Meh.

Doesn't really bother me. One tiny extension and the issue is solved. uMatrix is interesting, but it has the downside of breaking most sites without a lot of fiddling to configure it properly. FlashBlock is a lot less powerful, but does work rather more simply overall.

It's easy enough to allow common frameworks/CDNs across all sites (and then use Decentraleyes to use local copies instead). Anything which breaks after that deserves further attention.

Thanks everyone for the suggestions and safety recommendations. I would surely look into them. More suggestions are also welcome.