My concern is if we ever find a security bug which requires new information/behaviour in the submit ABI to properly fix. In this case it would be appropriate to backport a 'feature' (bug fix) which provides a new ABI but it would need to be a small change. A flags field where we can set a "PANFROST_ACTUALLY_BE_SECURE" bit would be useful then - but we wouldn't want to start bumping version numbers in the backport.
But at least for now we could just assume we'll expand the ioctl struct if we ever hit that situation, so no need for an explicit flags field.
I'm curious if kbase ever hit something like this? It wouldn't have occurred to me as a possibility.