Fullscreen also has security issues, more in fact, I believe? And it is not behind a flag. Also, mouse lock is enabled in Chrome in NaCl apps, but not HTML5 ones. So I am not clear on what's going on there.