We should consider specifying

The WebShare API is a policy-controlled feature identified by the string "web-share". It's default allowlist is 'self'. When disabled in a document, the share() method MUST return a promise which rejects with a "NotAllowedError" DOMException.

This way, the feature is disallowed by default in cross-origin documents in child browsing contexts.