>A coin being mined is controlled, handled entirely by first party, provides no incentive for tracking, etc.

Yeah, also a haven for hackers and malicious actors...

EDIT: I guess you weren't aware. CoinHive doesn't track the users who sign up for the service. It doesn't collect any information except email address. So malicious actors can easily sign up for the service and deliver the javascript through an XSS vulnerability for example. I thought that's what you meant by "no incentive for tracking".