I'm not sure I'd call this a security header, as all of the features controlled by feature policy already have their own systems in place for ensuring they don'

I'm not sure I'd call this a security header, as all of the features controlled by feature policy already have their own systems in place for ensuring they don't hurt user security. A site can't get your GPS location without asking your permission, regardless of what a site's security headers say. Rather, this seems more like an anti-annoyance header; it lets sites and server administrators restrict the behavior of content they're serving to ensure it doesn't annoy the user. The most obvious use case is for ads: a site could, for example, specify that ads are _not_ allowed to play audio; and the user agent would enforce that.