No one is selling it as a feature, no, but I would still consider it an OS level bug, and a security one at that. Focusing on the browser is a step away from the point: if I'm not signed in, I don't want sound playing from any app⁰.
I've had Windows do something similar, a media player deciding to unpause when coming up from hibernate (this was before Windows seemingly broke hibernate) and for some reason being at full volume, and it was a fair few seconds before I was able to login, get to that app, and hit pause again. It didn't leak anything sensitive (Hey everyone, this guy watches Stargate!) but it made me “that guy we all hate” on the train… Again it is the app that is responsible for making the sound, but I think at that point the OS shouldn't let it.
<glasses tint="rose">I miss the times when laptops had physical volume sliders…</galsses>
To me this has the feeling of making a mountain out of a molehill, but I don't think there is any denying that the molehill itself exists and to others it might be more than the very minor irritation it could be to me.
> I bet that if you configured the browser to never auto-play, this wouldn’t happen.
I bet that no matter how tightly you try to control that, some advertiser will find a way to override it to make sound play, and sods law says that will happen when you most want your waking laptop to be quiet. Blocking audio while not signed in at the OS level is a safer gate.
----
[0] Actually, there is an exception there: if the machine has locked due to input inactivity, I want audio I'm listening to continue and notification pips to come through. There is a distinction between OS restarting (from [re]boot, wake, etc.) and local console not logged in due to input timeout, in how I'd prefer things to behave.