Experiences like this make me wish there were chromebook like machines that didn't spy on users, because that's really the only ethical solution.
Non-technical users can have the locked down machines, with a way to opt in to a higher degree of access possibly, and power users can get the full machines.
I know this sounds elitist of me, but this is the only way I honestly see everyone getting what they want.
I think HTML should be split in web sites, and applications. If a page wants to use the camera, or vibration, etc., it should take you to "Programs & Features" or the Apps settings and say:
"This website XXX is a program, not a page. Do you want to install this program?"
I would even consider make the list of "programs" visible at all times on the edge of the last start screen page, and limit it to 12 programs or so, in order to prevent people from installing all kinds of junk.
You have reinvented native apps
The problem is when all your user experience studies grab folks from tech communities, you start to think people can or want to cope with your constantly evolving stack of features, when they probably just want to find out how to get to a restaurant that day.
I really feel a lot of people in Silicon Valley have not ever just sat back and watched a non-technical user use a computer: The state of the industry is woefully disconnected from actual user experience. I beseech anyone who thinks a permission prompt solves a problem, rather than creating one, to go to a senior living community, and just watch people use computers.