>>894786 (OP)
As far as I can tell, js is fundamental to ZeroNet, and you can't browse "zites" without it. js creates a huge attack surface, which doesn't totally render Tor (not TOR) useless, but certainly puts a dent in it.
By design, you're storing and updating local copies of zites on your computer. Let's say you visit a chan bunker zite. You don't frequent it--almost nobody does--but it gets automatically updated in the background. One week, somebody uploads a bunch of CP to the zite. It gets automatically downloaded to your computer. How long until you notice it and purge your hard drive?
Yes, I know, muh decentralization maymay, but if people are willing to go to the trouble of downloading and configuring Tor to work with ZeroNet, why not just take ZeroNet out of the equation and have somebody host a Tor hidden service? v3 hidden services are coming soon.
If you really want decentralization, there's Freenet.