Looks really cool, but I find myself thinking about the privacy implications of using this, especially by default. Even if the user gives consent, it still implies recording every single mouse movement and keystroke on the site. Has this been normalised? Is this the new default? Food for thought.
From what I understand rrweb is not introducing or hijacking any browser functionality -- it's just using what's there. Whatever boundaries are being crossed should be considered already crossed, because firms that want this data don't have to work that hard to get it (or they can just buy some off the shelf tool).
If the privacy implications make us uncomfortable we might want to start not sharing this kind of information from browsers by default (this seems unlikely) or at least introducing some sort of browser-level controls. Unfortunately, this represents a lot of work and worries about breaking backwards compatibility contrasted with very little gain for browsers that don't pride themselves on being good for privacy(Chrome).