That's good, but might be too blunt a hammer. What should be is a standard way to turn them on/off per individual site, WITHOUT unsolicited popups.
>Having a web feature off by default is essentially damning it to not exist, so that's a non-starter.
As an IT teacher in a past life I've seen 10 year old kids go through 10 layers of obscure program settings to enable a particular behavior / proxy their way out of a school network / etc.
If people care enough for notifications, they will find a way to enable them. If they don't, no harm done.