And once Google and Facebook find a workaround for that setting, they can add a fifth option: really really block all third-party cookies.

Seriously, the answer here is that if a browser wants to block third-party cookies by default, it should go all the way and do so, no exceptions. If social networks want to plaster the entire web with their buttons they can try asking browser users to change the setting back.

Do we need another setting for "no, really make my default font Arial"?

A setting is a setting.