Comment by slondr

If you take your plan (sans the final point) and replace "shipped with the browser download" with "only downloaded once the first time it is needed" then you basically describe how pre-webpack websites all worked. Everyone was putting the CDN url for jquery in their html head and browsers were reading from their local cache for every site after the 1st.

I think it's still perfectly possible to do that with React but everyone wants to write JSX and transpile it instead of doing this procedurally so it gets webpacked anyway. Caveat, I haven't touched React in about 4 years so I don't know if that's still true.

Your final point about disallowing more than X updates per year is unworkable due to the unpredictability of security patches.