Why is deferring execute to a button any better? A user that visits a site is implicitly trusting it; it doesn't take additional trust to click a link (or hover over a link, for that matter). Sandboxing js to only user explicit events will take us back to the browser stone ages.
It is much better security/performance-wise to only run programs you intend to.
There are sites you visit every day like HN, and there are those sites you rarely if ever visit. Perhaps a link from a link to one of the stories here.
Not allowing those sites to autoexecute code is very powerful. Hell, not allowing tracking code to run at trusted sites is just as powerful.
With Flashblock et all, I can go to strange urls and not have to worry about dangerous, performance sapping shit getting loaded. There is a whitelist for sites/scripts I choose to enable.
If you've never used NoScript/Ghostery give them a try. Your eyes will be opened to the sheer amount garbage loaded even on "trustworthy" sites.
