default(attributes..) is no needed. You can already do this by:

pure @safe:
// your code

But what is needed is some way to disable those attributes.  As you mentioned  one way could be done by allowing this:

pure(false)  or pure!false or @disable(pure,@nogc...)

From implementation point of view it is not hard.  I have already implemented this before. I have even write some old DIP. But there is new DIP process so someone need to write a new one and need to be able to get it throw new DIP process. And I do not feel I have enough strength to do this right now. 

čt 20. 12. 2018 8:50 odesílatel Dgame via Digitalmars-d-announce <digitalmars-d-announce@puremagic.com> napsal:
On Thursday, 13 December 2018 at 18:29:39 UTC, Adam D. Ruppe
wrote:
> The attribute spam is almost longer than the function itself.

I often wished for something like

----
module foo.bar;

default(@safe, pure);

function foo() { } // is annotated with @safe & pure

@deny(pure) // or pure(false) as I suggested a long time ago
function bar() { } // is annotated only with @safe
----

That would IMO lighten the burden.