Let’s add Javascript to that list too.
Not all sites need it, and given the abuse it’s responsible for, it shouldn’t be permitted unless a user opts in.
And 99.999% of internet users will therefore be trained to blindly click "accept" on any permission popups a website shows them, since outside of HN pretty much everybody loves and appreciates the rich functionality javascript provides.
Or not, when they inevitably discover that leaving it turned off bypasses 90% of newspaper website paywalls whereas turning it on slows their browser down to a crawl and floods their screen with ads.
That single move from Microsoft more or less eliminated the need for any normal application run by any normal user to require admin-rights to function, something which up to that point more or less had been the norm.
Developers fixed their applications to work with a sane privilege level and pretty much everyone was better off.
Let’s do the same with the rampant JS-abuse on the web.