> It does create some interesting security implications that I hope get addressed properly.

They won't. Both Mozilla and Safari pointed out the security issues and refused to implement WebUSB (along with a host of other APIs) as specified.

Google said: we don't care, it's now enabled by default in Chrome.

https://webapicontroversy.com