It's not the presence of WebMIDI that's the problem. It's the devices it can enumerate. Same with their other Web* APIs that want to enumerate devices outside the browser's normal sandboxing.

So what? You need to give access to each website that wants to interact with WebMIDI. It doesn't just let any website poll the devices. It's no different than the location API or any other API - the user has to explicitly grant access to each website that wants to use the API. If you don't trust the site, don't give it access. It's really as simple as that.

Sorry chicken little, the sky is not falling.