I think we get enough WONTFIX's from browser devs as-is. How about just ship sane defaults, enforce permissions as configured, and let us determine what's acceptable on a case-by-case basis?