With your threadmodel I doubt you need tor in safest mode, you can step it down for the setting that allows most JS and only blocks malicious ones. Tors default mode wouldn’t be the default, if the Tor team didn’t consider it safe for most users. Most websites require JS because its really useful

Do you run qubes because its required by your threadmodel or for education/fun?

Depends on your threadmodel. For encryption software (like the mentioned email providers) it makes more sense to use native applications, as its more obvious and documentable if an update gets pushed that messes with the encryption or private keys. With a website you need to trust the webserver to send the correct web application at every time. That is also the reason I have heard for Signal not offering a web app. For clients there is also the option for additional assurance via reproducible builds although sadly neither support that.