At least with the webcam/microphone/notification APIs the average user has a chance at understanding what's going on, they are not being given the same choice here, and that's what I take issue with. Believe me I get it: every week there's some site that makes me go "what on earth do they need push notifications for?" -- I'm still happy to make that choice, though.
If this is about giving the user's more control over what they see: then the setting should not be hidden in about:config, full stop. I know this may be lost on the HN crowd, but doing that relegates the functionality to a small fraction of power-users.
You know what, I think we agree! That's two votes for "move some stuff out of top-secret about:config and into Settings where the mortals can actually use it, it's useful for them."
So why stop at a pop-up for AutoPlay video?
"The website has requested permission to have autoplay video. Grant (Y/N)"
but also
" " " " .. requested permission to display notifications.."
Why stop there?
" .. requested permission to autoplay media with sound .."
and why not
" .. requested permission to set/store cookies "
Finally, after a drum roll:
"Sign up to this mailing list!" - unblockable JavaScript popup when you're a third down the article.
How many bloody popups would satisfy every single website publisher? Turn all the damn things off, let the designers figure out if they want to point a big giant arrow GIF to where the "Click Here" button to play the video is.