In my limited understanding content blockers seem more sane as they doesn’t give the extension cart blanche to read your pages and write to the DOM. Instead it passes links to content the browser wants to load into the content blocker as a filter function.
The seems very sensible given extension owners could start injecting malicious content on the page. Nothing prevents them from selling out — it’s happened before.
I use uBlock origin and love it in Chrome but I can also see where Apple is coming from here. This will probably protect the greatest number of their users.
The way adblocks like UBo works isn't by injecting stuff in the DOM. Instead, they look at requests going out, and can ask the browser to "fail" it. It can do that based on custom logic - a piece of javascript code runs for every requests.
UBO also has the facility to delete/hide arbitrary nodes from the DOM in order to hide ads that might come bundled with the page.
None of those functionalities can really be used maliciously. At best you can break websites by denying them the ability to load stuff. The problem is that both functionality are bundled with other privacy-invading things (like injecting or reading). But that's of no fault of UBO, it's just the way Safari and Chrome decided to set the permission granularity.
You could have a secure, restrictive API without blocking the best features of UBO. Google chose not to because it's potentially damaging their business model, and Apple probably chose not to out of simplicity.
I think that this, i.e. with request and element filtering, is how it works the majority of the time. However, uBlock Origin can (and sometimes does) inject arbitrary scripts into the page. They can it "scriptlets", see this link: https://github.com/gorhill/uBlock/wiki/Static-filter-syntax#... . You can see some usages in the "uBlock Filters" filter list included with uBlock Origin. I think it's more the exception rather than the norm, but it's there.
My fear is that if extensions are crippled and mainstream ad-blocking standardizes on those kinds of restricted "content blockers", it's possible for ad companies to implement an effective technical bypass for them, since they can execute arbitrary scripts, but "content blockers" can't, unlike extensions. You would need Apple/Google/etc. to play the ad-blocking arms race, and they probably won't have incentives for it.
The seems very sensible given extension owners could start injecting malicious content on the page. Nothing prevents them from selling out — it’s happened before.
I use uBlock origin and love it in Chrome but I can also see where Apple is coming from here. This will probably protect the greatest number of their users.