Correction to this post after playing with uBlock Origin Lite for a bit—it does *not* require per-site opt-in, defaults to a Basic limited permissions filtering mode:

Basic: Basic network filtering from selected filter lists. Does not require permission to read and modify data on websites. Optimal: Advanced network filtering plus specific extended filtering from selected filter lists. Requires broad permission to read and modify data on all websites. Complete: Advanced network filtering plus specific and generic extended filtering from selected filter lists. Requires broad permission to read and modify data on all websites. Generic extended filtering may cause higher webpage resources usage.