I feel indifferent on this proposal.
I certainly think the PVP is wrong in the case when a library both adds a newtype or data type declaration and then adds an instance for it, as it's impossible to break downstream dependencies in this way. So I've been ignoring the strict letter of the PVP in this particular case, although I'd argue that I'm still following the spirit of the PVP. So whether or not this change is adopted, I do think this point should be clarified.
My opinion on orphaned instances is that they should (almost always) be avoided in hackage-released libraries, but that they are mostly harmless in executables, whether hackage-released or not. So under these assumptions, it's still possible to break something; the question in my mind is whether or not it would be more work to tighten up dependencies after the fact (under the optimistic assumption that things usually won't break) or loosen things up. Given that I'm not, at the moment, a fan of upper bounds at all, I don't feel like this tradeoff impacts me much. (Although obviously I'm coming down on the side of the optimistic assumption.) But I do think it's important to have a good semantics for the PVP.
(And incidentally, once (if?) we start adjusting version ranges without updating the version of the package, then I will adopt upper bounds, and I also feel that this issue would become mostly moot anyway.)
I also second Christian's comment that we really do need a more coherent story on orphaned instances, as avoiding them really does put a damper on modularity.
Best,
Leon