Block by default, and not ask by default? That seems unfortunate to me, and will definitely break one of my services for Firefox users. I have a site which coordinates watching videos amongst a party of people. To the browser heuristics it looks like "autoplay" (the host starts the video manually, and some scripting on the page kicks it off for everyone else and works w/ the backend to maintain something resembling stream sync.) This is a consensual thing, you click the host's invite only link, you're taken to a landing page that tells you who made the link and briefly describes the service. Presumably you would not have clicked through all that if you didn't want to watch a video w/ the host.
I already had to deal w/ increased complaints from users due to scripts no longer being able to start the video in Chrome when the user hasn't interacted with the DOM yet. The only warning was an error in the development console. Users would get incredibly confused because they'd join the room and "lurk", i.e not interact w/ chat or the site, and then they'd be left wondering why everyone is commenting on the video when their's hasn't started playing.
I realize autoplay gets a lot of flak due to large corporations using it to further their aggressive marketing campaigns, but there are legitimate use cases out there which you will be breaking w/ a block-by-default policy. I'd urge you to reconsider ask-by-default, or at least allow scripts to have some sort of API whereby they can ask the user for permission ahead of time.
This just really sucks, because it's hard to communicate these sorts of things to my userbase which has wildly varying degrees of technical competency. It's also unfortunate to, essentially, need relay the message "some organizations (ab|mis)used this useragent functionality, so now nobody gets to use it."