I think security is within the purview of a browser. Even if I disagree with the implementation.

And AMP is not a browser feature.