> Especially because they would still have access to canvas and WebGL.
Those should also be behind a (or the same) permission prompt.