If the proposal was limited to opting into strict origin scope (instead of eTLD+1/registerable domain scope) for cookies and other privacy-related things, it would be an improvement.

But it also allows things like specifying that laptops.shopify.com, laptops.com, laptops.social.com, desktops.com and calculators.com are the same party and therefore tracking may happen across them. There's no obvious good way to put the user on notice of this, and the Explainer totally punts on addressing this problem, instead leaving it to each browser to figure out.