This is literally what Safari does on iOS. Lots of APIs, like playing an audio file or a video stream, need a user event (read as: touch event) fired beforehand

This is literally what Safari does on iOS. Lots of APIs, like playing an audio file or a video stream, need a user event (read as: touch event) fired beforehand in the same callstack, otherwise it won't work. Lots of webdevs abuse this, however, to start an interval with "privileged" rights that will do all things just in a centralized loop after the user did the first interaction with the website. So I'd kinda argue that this security concept is a little flawed. Something like OPs approach to override the APIs with monkey patched checks seems promising. I hope there won't be bypasses or quirks with different web worker or iframe contexts.