I hate that Tor Browser starts up in Whonix disposables with the weakest security setting and Javascript enabled. Here's how to change it:
1. open a terminal in the whonix-workstation-17-dvm template
2.

sudo vi /rw/config/rc.local

3. add this:

cat >>/var/cache/tb-binary/.tb/tor-browser/Browser/defaults/pref/autoconfig.js <<'EOF'
pref("general.config.filename", "tor-browser.cfg");
pref("general.config.obscure_value", 0);
EOF

cat >>/var/cache/tb-binary/.tb/tor-browser/Browser/tor-browser.cfg <<'EOF'
// TORBROWSER DEFAULTS
lockPref("browser.security_level.security_slider", 1);
lockPref("intl.language_notification.shown", true);
lockPref("javascript.enabled", false);
EOF

chown -R user:user /var/cache/tb-binary/.tb/tor-browser/Browser

4. shut down the template
5. start tor browser in a whonix disposable and check your settings

idk why Tor Browser ppl seem so keen to not let you change that security slider but I tried both distribution/policies.json and user.js, and neither let you set the slider down to safest. only lockPref does it?? You can set javascript.enabled false in user.js if you don't want to lockPref it but you can't do that in distribution/policies.json either.

Credit: a mix of
- /u/auraaura on /post/8e3975b778b4fdb22290
- http://eweiibe6tdjsdprb4px6rqrzzcsi22m4koia44kc5pcjr7nec2rlxyad.onion/tpo/applications/tor-browser/-/issues/41523⚠️
- and me=)