Are there any acceptable uses for $_COOKIE['has_js'] outside of core?
I don't think so, for many separate reasons.


Given the comment made to 8.x change records Removed has_js cookie:


  Only Batch API used it as a workaround. A clean solution has been reached avoiding the need for the cookie.


I would extrapolate that any solution that uses it should be considered unclean.
There is no page for it on api.drupal.org so it appears it wasn't designed to be used outside and it's not guaranteed to stay unchanged. It's a common in IT to assume one uses undocumented features at his own risk.
It can be unset if JavaScript is on, but Cookies are off, so it cannot have a clear meaning.
It can be unset if some module will successfully try to make site EU Cookie Law compliant (and user didn't agreed yet)
If you read it from PHP, it will be unset if your page is first one loaded after "open in private window" or "clear cookies" click, no matter what are client's JS and Cookie settings.


Reasons in no particular order.