A few comments about the degree of security that RequestPolicy provides:
– Attackers often subvert advertising to get their content into otherwise-legitimate sites, which is a lot easier than embedding their content in the page and getting a legitimate site to host and serve malware. They also like to steal session cookies, login details, etc, and send them to the attacker's site – which RequestPolicy will block. I think that attackers will have a harder time than you suggest in making the switch to all-embedded attacks.
– For those situations where you've visited the actual site that hosts the malware, NoScript can provide the knockout punch to stop the scripts in their tracks. After all, malware sites probably aren't on your NoScript whitelist. RequestPolicy stops sites from subverting your trust relationship with legitimate sites, forcing them to serve content under their true colors.