The security model is one of the hard parts that needs working out, yes. This is just an announcement that there is a plan to work one out in case people want to participate instead of just having stuff dumped on them from on high when it's done the way Google and Apple do it.

Browser asks the user for permission to do stuff, the really sensitive stuff is pushed back to happening on click events, the even more sensitive stuff runs through code validation. What extra security is needed than what we already have with the above?