The RFC seems to presume that to make a feature extensible it should be removed from core and put into an extension. I believe this is a fallacy. In the first place you don't even need to remove something from core to make it possible to plug in completely different code.
Being an extension is not a prerequisite for experimentation. Some features do belong in core, including experimental ones. We should encourage ideas of near-ubiquitous features and experimental incremental improvements of core features to be done in core, not move things to extensions just to improve or extend it.
In the case at hand. I see no reason to remove protection from core. If there is a good idea for improvement to our protection system the core code should be improved, such an improvement shouldn't be segregated to an extension only available to the few who bother to install it. And if it's a feature only useful to a few it should be built as an extension and we should make sure that core has enough hooks and interfaces to make it possible to write. But we shouldn't remove the already universally useful protection we currently have just to do that.