WebGL can easily be disabled from a command line option passed into most WebGL compliant browsers. Also; who says that WebGL HAS to run whenever a page requests it? Couldn't browsers make it so the user is required to OK the use of WebGL before it runs on the system? There's nothing that says that a browser can't do this.
A prompt doesn't help - the prompt would be "Do you want to see the 3d dancing bunnies?" And there is only one reasonable answer to that prompt: Yes. Because the user ALWAYS wants to see the dancing bunnies.