Fullscreen requires a user interaction. Pointer lock requires the page to be fullscreen. Screen Orientation might require the page to be fullscreen.

If we had to have a permission associated with those features, how should the "retrieve the permission state" algorithm behave? Given that getting the permission state is asynchronous, code checking the state and using the feature would not work.

This said, it sounds unlikely that features like fullscreen or pointer lock need to be associated with a permission. Their security model is working fine as is for now.