What’s the best way using vanilla js to force confirmation on publish button?

You can call event.preventDefault() on the event object that is passed to the handler:

publishButton.addEventListener('click', function (event) {
    if (!confirm('You need a layout')) {
        event.preventDefault();
    }
});

which stops the event being passed on to the next handler.