uMatrix is default-deny by default, except 1st-party scripts. It also comes with an extensive lists of hosts files enabled (representing 10s of thousands hostnames and their subdomains) by default for which scripts won't be allowed at all, even as 1st-party.
NoScript is default-deny by default, except for its preset list of whitelisted hostnames for which scripts are allowed to execute.
In both cases, with a few clicks one can reconfigure to their liking, to further restrict or relax existing rules.
Here is my thinking on this: between blocking everything and allowing everything, there is a point I consider optimal, which is what I picked for uMatrix. Not blocking enough out of the box will defeat the primary purpose of the tool. Blocking too much out of the box will discourage many users from using the tool at all -- they will uninstall.
My goal is for as many people to protect themselves, and this won't be accomplished if I set uMatrix's default to cause too much work out of the box that they uninstall it out of tediousness.
Blocking everything 3rd-party by default except images/css is what I personally identified as the optimal -- this would correspond to "medium mode" on the graph at that page: https://github.com/gorhill/uBlock/wiki/Blocking-mode
Again regarding the tediousness factor, another important aspect of a tool such as uMatrix is how easy it is to set rules to block/allow things, including on a per-site basis: one can easily change default settings after install, but how easy/difficult it is to set/remove rules is something which can't be changed. To dismiss the ease to create rules and other core features in uMatrix because one personally disagree with its (easily changed) default settings out of the box does not make much sense to me.
If the end result is that the aggregate number of stuff blocked by all users of uMatrix with default settings is higher than the aggregate number of stuff blocked by all users of uMatrix with hardcore settings, then i reached my goal.
In any case, as said, the defaults can be changed easily with a few clicks, there is no "hidden" settings, what is blocked or not is up front and visible right after install by just looking at the popup panel matrix.
One thing I would like people to keep in mind: uMatrix is not NoScript or RequestPolicy, it is its own thing.
