Some of them can be, but not all. Some headers are needed before the content is loaded. With ubiquitous virtualisation these days, I don't see why hosting providers can't allow users more control over their server without compromising security.