In the consent section:

The default audio output device is always authorized.

That seems problematic unless there is a "null" output device. I often want all web pages to be unable to make sounds (I typically do that at the hardware level by inserting a blank jack into the headphone output, but that is suboptimal).

It looks like there should be an option for the user to remove consent from the default audio output device.