Focus state is unspecified when user agent itself loses focus.

[tobie]

This makes it difficult to normatively stop certain behaviors (such as collecting sensor readings) when the app is unfocused but stays visible.

This can notably allow PIN skimming attacks using sensors.