If they were genuinely interested in dogfooding their own stuff to ensure it works properly, they should also be dogfooding the process of white-listing plugins and websites, not to mention handling graceful fallback when the user cant or wont do that.

That's a big part of getting the end-user experience to work well and can't just be "tacked on" later.

You're just adding things that probably aren't within the scope of the project.

For instance graceful fallback is a 'nice to have' but not necessary. If you deny flash or javascript, essentially most sites simply break. I imagine a native client plugin would have the same results if you don't enable it.

As for white listing, why can't it simply be handled with the same dialogs used for whitelisting all the other existing extensions per site?