Even though 90% of the use cases for Web MIDI are to allow someone to use a computer to provide access to an analog synth's features, there's no way to know if that synth has, say, bluetooth or wifi on it, and can be manipulated to do bad things.
It is a shame, because allowing the use of web technologies to make sophisticated apps like synth controls would open it up to a lot more developers. And synth hardware design often leaves a lot to be desired.