Mozilla were the first to implement (Vladimir Vukićević’s work) with Opera around about the same time. Chrome jumped on board a few years later, and IE as of version 11. Apple was the holdout for basically unknown reasons (they’ve had a working version preffed off for ~5 years now) but the basic assumption is that graphics card drivers needed to be hardened to provide a secure execution environment for shaders. It’s one thing to buy a game and give it root, quite another to load a webpage that could start a WebGL process in the background and load executable code onto the graphics card.
Security is definitely the likely candidate (it was for Microsoft as well): even on Yosemite, where they enabled WebGL by default, there's a per-site permissions interface similar to things like location services access.