We already inspect js controllers and strip out any that aren't explicitly allowed.
"id" can't be allowed, as it can lead to issues as already noted. It can break javascript on the page, cause other oddities, or even potentially introduce security issues (what if a user pasted an HTML markup that looked like the login form with the id of the login form element on the page, but which sent the credentials to a remote third party? A user could click to login, which would load the nefarious (but normal looking) login form HTML, and submit their credentials to a remote endpoint. In theory at least...I do believe we strip forms out already, but you get the idea.
I don't really have any qualms about "name" but as noted, it's kind of deprecated so it seems a bit meh to allow.
The reality is, this type of thing is so seldom needed that it is probably best to just leave to a custom plugin. If we start seeing a lot of clients installing custom CKEditor plugins that need this functionality we can revisit.