It should be possible that all content entities also have automatically a permission tab for object permissions. Here I'm not yet sure what the perfect way is. We have yet some performance issue on media. I also would make permission always opt-in on developer side, this way when they are not needed can be disabled and the query is a lot more performant.