If they did, then Gallery::ready() also wouldn't be called (no theme, no user), logins would be bypassed from private gallery and/or maintenance mode restrictions... in other words, this would be really hard to do without noticing.

IMHO, I feel like we're better off making a core that follows standards and sets a good precedent for contrib modules than making exceptions to catch really badly-written contrib modules that make the core less clean to follow.  To the best of my understanding, using the before() function is the Kohana-sanctioned place to do security and auth related activities.
https://github.com/kloopko/kohana-admin/blob/master/classes/controller/admin.php#L21
http://kohanaframework.org/3.3/guide/kohana/mvc/controllers

That said, there is another option we could use: we could put this in a Response class override of send_headers(), which adds the header before they're sent.  This has the advantage of being impossible to override in anything except another Reponse class.  I still feel slightly funny about not using before(), but would feel much better about this option than leaving it as an exception in index.php.

Thoughts?