It would have been the only piece of every browser that 'just works'.
But hey having a "spec" on top to all the available documentation is super necessary so that some bloke on twitter can put it into their bio.
Even HTML doesn't have specs anymore, because they don't matter. They are a means to get all browsers to be compatible not the goal.
And Safari and Chrome still ship with WebSQL, so I don't think that "security issue" is actually there.