Most content models in core are currently unrestricted – it's possible to convert a page in mainspace to CSS, JS, JSON, Vue or even plain text, even though it should never be done. Content models added by extensions come with better guardrails – Scribunto, SecurePoll, JsonSchema, GadgetDefinition, and EntitySchema are allowed only on specific namespaces or namespace + title prefix.
To allow broadening access to the editcontentmodel right (T85847: Grant editcontentmodel right to all logged in users), we should audit usage of ContentHandler::canBeUsedOn() and make sure the right cannot be easily abused.
Another idea is to make move-protection restrict changing content model as well. Having a separate protection level altogether would be going too far.