When a window navigates, any extant references to its Location object still refer to the location of the outer window, and need to do permission checks and navigations as appropriate.
When a frame navigates from a local document to a remote document, though, any extant Location objects still perform checks and load operations against their docShell, which doesn't know that the frame has been navigated.
The simplest solution is to check the BrowsingContext rather than the docShell. For remote BCs, we can assume that the caller does not have access to the location, and reject any read requests. For local ones, we can fall back to the docShell for permission checks and to read the URL.
Navigations are trickier. For remote BCs, we'll need to use whatever logic we eventually implement for remote Location proxies. For local ones, we can just stick to the existing docShell logic.