Do… do they understand how this works? How anything works?

Not any list. A government provided domain blocking list.

A reasonable way to balance safety and freedom could be to require including some malware blocking list, and let browsers choose whether to offer this as opt-in or opt-out.

This way users could easily protect themselves, or just disable it if there’s over-blocking. Browsers could choose which blocking list provider they include (government or independent provider).