Display size is just a nice concrete example of something that seems quite harmless, but is not.

getClientRects is exactly the kind of thing that would be carelessly standardized by developers working for surveillance companies with little care for users' security. As I said, there is little reason for code supporting a web page to need that type of functionality. And if it "really" is needed, then the rendering specification needs to be based on a fully formalized algorithm (ala a networked game or Bitcoin) with every parameter quantified in bits. And yes, I realize how different from the current stack this would be.