I thought secure context restrictions were supposed to just be for dangerous APIs like screen capture and reading the clipboard. Why is it being applied to completely benign APIs that can be reimplemented in pure JavaScript?