The noscript tag was improperly used, whilst the browser extension is working properly. Besides that, the page result may be cached and therefore hard refresh (reload with override cache) is likely required.
Improper use
But the output I would expect is 'aaa ccc', because I'd expect 'aaa' to show when scripts are disabled, and scripts are disabled.
No, the expected output 'aaa' will not be shown because the noscript tag was improperly used.
HTML noscript tag on W3schools provides a concise explanation for the usage:
Definition and Usage [...]
The <noscript> element can be used in both <head> and <body>.
When used inside the <head> element: <noscript> must contain only <link>,
<style>, and <meta> elements.
Differences Between HTML 4.01 and HTML5
In HTML 4.01, the <noscript> tag can only be used inside the <body> element.
In HTML5, the <noscript> tag can be used both inside <head> and <body>.
In other words, the noscript tag used by OP is valid based on HTML5 but that does not follow the HTML standard. The noscript tag in HTML head element should not contain any "free text".
Page result
There is also a secondary issue that I work around, which is that if I disable or even 'remove' NoScript from Firefox, then I still get the same response of 'ccc' [...]
Most browsers including Firefox use cache by default, therefore hard refresh is likely required. This can be easily reproduced all the time, unless user has configured the cache behaviour differently.
Discrepancy 1: Hard refresh is performed via keyboard shortcut, which may be either Ctrl+F5 or Ctrl+Shift+R for Firefox. In case of browser extension, the cached effect may persist until the browser is restarted again (user experience may differ).
If I install 'uBlock Origin', and select to leave as is so not disable scripts, then I get 'bbb ccc' (fine). Whereas if I click to disable scripts on the page, then I get 'ccc'. The 'aaa' isn't getting displayed.
The noscript tag that contained 'aaa' is probably being ignored or omitted by the extensions, because 'aaa' usage does not follow the HTML standard. The noscript tag in HTML head element must contain only the three elements as noted above.
Discrepancy 2: The page result will be 'bbb ccc' also when viewing the HTML file locally in Firefox, even when uBlock Origin is enabled and the extended option "Disable JavaScript" is checked. This is likely due to the limited permission given to the extensions in Firefox Quantum. In other words, the browser extension is unable to block script for a local HTML page displayed via file URI scheme (not via localhost run by a web server, which is another different matter).
Try again
Consider the modified HTML content as follows:
<!doctype html>
<html>
<head>
<noscript>aaa<style>#this {color:#cccccc;}</style></noscript>
<script>document.write("bbb")</script>
</head>
<body>
<noscript>nnn</noscript>
<span id="this">ccc</span>
</body>
</html>
Then load the HTML in Firefox with uBlock Origin and its option "Disable JavaScript" is unchecked (OFF) or is checked (ON).
- If "Disable JavaScript" is OFF, then the result will be 'bbb ccc'
- If "Disable JavaScript" is ON, then the result will be 'nnn ccc', whereby 'nnn' is shown from the noscript tag in HTML body element and 'ccc' inherits the colour from the noscript tag in HTML head element
- In both cases, 'aaa' will never appear as explained earlier (does not follow standard)
Discrepancy 3: The 'aaa' will be visible only if JavaScript is disabled within the browser itself (Firefox hidden configuration, about:config - "javascript.enabled" set to "false"). Alternatively, use any text-only browser to see similar result. That is different from the option provided by the browser extension, which Firefox Quantum had limited by design.
TL;DR Use noscript tag in HTML body element, for making text visible when script is disabled. The browser extension is working properly according to the HTML standard but limited by design.
<noscript>aaa</noscript>.