There are actually two separate checks we already do:

1.  Disallow interpolation for `onclick`, `formaction`, and
    friends.  These attribs are always Javascript and we
    have better alternatives.  This fix is **not** about
    that.
2.  Require `$sce.getTrustedResourceUrl()` for
    `iframe[src]`, etc.  This PR is about this point.

[code.google.com/p/mustache-security][] has nice things to
say about the security of 1.2.  There are only 2 points
called out – of which only the first is significant and this
PR addresses it.

*I agree with you that this isn't exhaustive.*

That said, we aren't missing much and an affected app would
have to actively be using an attribute we've
missed.  Merging this PR is keeping in the spirit of what
we're already doing to `*[src]` and `xlink-href` – otherwise
we should remove those checks and just leave it to the
developer.