I don't think it is a security hole, but websites typically do
not get to set their viewport - the window size is under the
user's control. (one of the few things they have left under the
user's control!)
So if you told a site to set its own size... it wouldn't really
know what that is most the time. At least widths tend to be fluid
and variable. Heights sometimes are set dynamically too.
There's solutions to this - the containing page might set it to a
width, then let the height be fluid. That's what most the JS
solutions do and it works pretty well. But maybe that still feels
too hacky for the standards committees, or is just messy to
implement for the browser developers.
