Earlier, the plan was to have no plugin support at all in IE10 Metro. Microsoft is positioning the whitelist approach as a backwards compatibility shim for high-profile sites that won't or can't give up Flash.
And if this is controlled by group policy, then this allows them to increase security for end consumers whilst allowing business customers the ability to carry on supporting the internal use of Flash that they may (feel that they) require.