There are already tons of HTML specific HTTP headers (Link, CSP, X-Frame-Options, etc.). I don’t see why HTTP headers shouldn’t be used for metadata when serving HTML, it’s not like the header needs to be added to the HTTP spec.
I think that the document itself should have knowledge about its security requirements (the "allow" field in <iframe> tags requires this), so it seems awkward to have part of the responsibility in the HTTP server and another part in the HTML document.
I'm sure there are other examples of HTML specific HTTP headers that can't be specified as meta tags because we're still stuck with a lot of crud, but that doesn't mean they're not out of place too. It's just the wrong layer for that data.
I've had iframes completely disabled in uBlock Origin for years now and the only time I've found it "breaking" ("fixing" from my perspective) things is when sites do something like third-party run sweepstakes. I think we'd be better off just breaking iframes now for the sake of our children, like we did with Flash et al. Start off with "click to activate iframe" with harsh warnings, then completely remove support shortly after. There are better solutions for sites that are using it for legit reasons.