Consider the same rationale for security: let's allow any user to do anything with our ecosystem, unless we know them to be malevolent.

I'd argue that the human body is a lot more worthy of defending than a cloud platform. I'm totally fine with a whitelist model.

Cannabis was a fluke; legislation was pushed through by a political opportunist despite the AMA pointing out that there was no evidence of harm caused by cannabis. The regulation model in itself is fine, we just need to take the people out of the decision making. :-)