I looked at your site and I wanted to do the same to mine. So I went to the file include/xoopsjs.php and cut all static content into themes/default/static.js. So far I saved 4k!
http://trubadur.usr.ro/themes/default/static.js

Take a look at what's left:
http://trubadur.usr.ro/

I think I did a very clean hack, can work for everybody, and if you change the language, it still works.

Forgot to add the link to xoopsmembers module. You can see it's disabled for anonymous users.

http://trubadur.usr.ro/modules/xoopsmembers/

With me, it's the reverse. I'm trying to hide that information and I can't.

I disabled access for anon users to xoopsmembers module, but they can access userinfo.php file with no problems with links like:

http://trubadur.usr.ro/userinfo.php?uid=1
http://trubadur.usr.ro/userinfo.php?uid=2

And so forth.
They click on the links from "Who's online" and "New members" block, and maybe others.

I'm very interested how you made a "no permision" for that file.