All Lemmy instances on v0.18.0 are inaccessible with javascript disabled. The only way to privately browse Lemmy instances now is via kbin. I was hoping that Lemmy was going to focus more on privacy with the coming updates. Maybe this will be fixed in v0.18.1?
JavaScript itself has nothing to do with privacy. I assume you think so because you are using Tor Browser at the higest security setting that disables JavaScript entirely?
IMHO just stop using that broken-by-design browser and use a browser extension with a JavaScript allow-list.