As every plugin has different funtions, it’s difficult to prefix a standard value of permissions, but execution ones for the world are sometimes neccesary because some plugins use this way of external support for scripts or css.
About the checking that automatically detects when a new plugin script needs to be added to the Plugin Firewall whitelist, an option could be “When resolved, dismiss here”. Anyway, that’s a good idea.