Exposed is about the members too and is definitely needed as far as I know.

Context: https://url.spec.whatwg.org/#api

Do you mean that without [Exposed=(Window,Worker)] on URLUtils, the members of URLUtils would not show up on URL in workers, even though URL itself has [Exposed=(Window,Worker)]?

Yeah, I think that's the case. bz can probably help us out here.

Comment 2 is correct.  Exposed annotations on interfaces do two slightly separate things: they indicate where the interface name is exposed (for interfaces with an interface object) and they set the default exposure set for the interface members, which can then be overridden (well, narrowed down) via [Exposed] annotations on the members themselves.

In the case of mixins (aka. things pulled in via "implements") the mixin, not the interface it's mixed into, sets the default exposure set for its members.  At least the way Web IDL is specced right now.

One other thing.  This IDL:

  [Exposed=(Window, Worker)] interface URL {};
  [NoInterfaceObject] interface URLUtils {};
  URL implements URLUtils;

is actually explicitly invalid.  http://heycam.github.io/webidl/#Exposed says:

  An interface's exposure set MUST also be a subset of the exposure set of all
  of the interface's consequential interfaces. 

Fwiw, this is implemented correctly in Gecko.  If I drop the Exposed=(Window,Worker) from URLUtils, our IDL compiler says:

 WebIDL.WebIDLError: error: Interface URL is exposed in globals where its consequential interface URLUtils is not exposed., dom/webidl/URL.webidl line 19:0
 interface URL {
 ^
 dom/webidl/URLUtils.webidl line 18:0
 interface URLUtils {
 ^

Thanks Boris and Anne! I didn't realize that there was more to [Exposed] than the interface object itself, but it makes sense.