Yes, permission should be required for both vibrate and simple sound. The fact that we haven't had this has led to auto-playing videos disrupting the user unnecessarily. There is no question that both should be controlled by the user.