As further security measures this value would only be settable when the registering API call is made within a user gesture, similar to the way the Webkit [StorageAPI] requestStorageAccess() is constrained, and only when the request is secure, i.e. delivered over https.
The StorageAPI citation is to a WebKit blogpost; it may be more effective to reference the WhatWG discussion standardizing the API, https://github.com/whatwg/html/issues/3338.
In the July 23, 2018 Editor's Draft of Tracking Preference Expression (DNT)- Purposes Extension Addendum, the Introduction says:
The StorageAPI citation is to a WebKit blogpost; it may be more effective to reference the WhatWG discussion standardizing the API, https://github.com/whatwg/html/issues/3338.