The browser should offer some kind of permission system (like with the GPS sensor) that would ask the user if a website has permissions to access the vibrate API.
That's kind of ridiculous "example.com wants permission to make your phone vibrate".
It's just like using location information. There are cases where it might be appropriate, such as web-based chat, or webmail. But there are many more cases where it would not be appropriate.
What's kind of ridiculous is every advertisement under the sun begins vibrating the device.
You can toggle Firefox's "dom.vibrator.enabled" about:config pref.