I think that this, i.e. with request and element filtering, is how it works the majority of the time. However, uBlock Origin can (and sometimes does) inject arbitrary scripts into the page. They can it "scriptlets", see this link: https://github.com/gorhill/uBlock/wiki/Static-filter-syntax#... . You can see some usages in the "uBlock Filters" filter list included with uBlock Origin. I think it's more the exception rather than the norm, but it's there.

My fear is that if extensions are crippled and mainstream ad-blocking standardizes on those kinds of restricted "content blockers", it's possible for ad companies to implement an effective technical bypass for them, since they can execute arbitrary scripts, but "content blockers" can't, unlike extensions. You would need Apple/Google/etc. to play the ad-blocking arms race, and they probably won't have incentives for it.