There was a brief discussion about this code on Twitter a few weeks back and I asked for extra clarification from engineering. Erik Kay explained on that bug ticket [3] a bit more:
"We don't enable NaCl on the web at large because we don't want to see a particular instruction set baked into the web. We enable it for apps that are in the Chrome Web Store (even hosted apps which are in the web) because it's a place where over time we can get developers to migrate to PNaCl. For this whitelist, we have similar controls to what we have on the Chrome Web Store, and our goal is to eventually remove the need for it altogether."