(Most) Bots don’t do JavaScript — because that’d require an entire new engine on the client end, which consumes some resources; resources that they’d rather use to do more bottling. By turning off cookies and JavaScript, the “privacy conscious” user is making themselves look like bots. Vast majority of site operators doesn’t want bots, so they employ mechanisms to detect bots to prevent bots from accessing their site… so if users make themselves look like bots, and operators don’t want bots, then the users must be prepared to deal with the repercussions of their actions (of disabling JS and cookies).