Letting witnesses configure it gives us flexibility so that if we want to adjust it later, we don't need a hardfork or replay.

A possible downside is that a witness decides to ignore the other witnesses and ends up bricking accounts. But I think that's a risk with almost any op, not just custom_json. A witness doing that has to modify steemd and explicitly attack the community, which is grounds for unapproving such a witness.