The ''default policy'' IS correct. Having it in reverse is a security risk, nullifies using the addon in first place and makes it pointless.

"so that users may choose to block nothing until they encounter a problem site (and then block JS if they want)."
- and by then it would be too late. My comment was spot on and needed to stop the useless spamming. The addon you want is noscript (or none at all).