Accessing other services via TCP is not mentioned in threats

[alvestrand]

Example: Many organizations permit submitting mail from an user's PC unencrypted and unauthenticated.
This extension would allow any Web page or service to connect to port 25 of the mailserver and inject mail.

[ewilligers]

Instead of, or in addition to, showing the port number, the user agent can describe the well know use for the port, for example "mail" or "sending mail".

Web pages will only be able to connect to port 25 of the mailserver if the user enters the mail host name/address and consents.

Note also "User agents may restrict use of the API when enterprise software policies are in effect. For example, user agents might by default not allow use of this API unless the user has permission to install new binaries."