Security is definitely the likely candidate (it was for Microsoft as well): even on Yosemite, where they enabled WebGL by default, there's a per-site permissions interface similar to things like location services access.