> This reasoning, IMHO, ignores the fact that the user-agent still asks for consent, so the user may choose not to allow anything they can't audit

Aaaand we're back to the days of good ol' ActiveX.