Has always been the case I think, or ever since I started using Sailfish, from ver 2.x. I thought it to be weird at first. But in some way, it felt logical or quite fine. If you do not interact with screen, it locks the device, but since the video is playing and is in focus, screen does not blank. Access is limited to that particular browser tab. You might have left the video playing and left the phone unattended, which would be foolish I agree, in which case anyone could grab the device and access some already open private tabs or other data unless it is protected as it is now.