I agree with an opt out but it should be difficult. Like entering recovery mode and enabling a legacy mode from the terminal. That way if you’ve got some industrial application you’ve got a way. But malicious software has a hard time getting users to enable it.
Remember, we're talking about a hardware driver here! It has access to the kernel, so it can ultimately do whatever it wants, the API just makes it easier.
Something similar to disabling SIP mode on macOS.