A living standard is a form of specification. You can use it to implement a tool consuming HTML the same way the browsers do from scratch, and the browsers use the process to align their independent implementations.
Its not a specification though, because your implementation can never conform to it. You can't say "I have a html 5.x" compliant browser anymore because there is no fixed specification for it.
You can only have something that is "currently compatible with the other browsers". Same thing you would have gotten with SQLite.
It would have been the only piece of every browser that 'just works'.
But hey having a "spec" on top to all the available documentation is super necessary so that some bloke on twitter can put it into their bio.
Even HTML doesn't have specs anymore, because they don't matter. They are a means to get all browsers to be compatible not the goal.
And Safari and Chrome still ship with WebSQL, so I don't think that "security issue" is actually there.