I think that would be a great idea to have that commonly adopted metric. Would provide a clean picture of what a program is capable of.
There aren't any such indexes really, mostly for historic reasons and because people don't care in mass.
The closest thing we've got something like this is the application permissions on Android, that is for mobile devices. When you install an app, it displays in black on white what permissions it requires for operation and it's up to you to approve or deny them.
It still is not an index of application hygiene, rather an index of operation scope and potential threat.
That kind of index if ever pulled off would in practice rely on trust and reputation of a publisher not to distribute secretly an update after the initial version has been presented and tested. The thing is that there is no working and widespread mechanism on consumer PCs to restrict an application or even see what it's doing. By widespread I mean a simple built-in mechanism available and understandable by an average Joe. Yes, there user groups, permission levels and so on but a normal user will get lost there. Something as simple as the mechanism on Android is not available.
We first need to put that sort of protection barrier on each and every PC only then that would that index make sense. Without that mechanism, everything is based on trust - you will trust big ones without an index but you won't trust the small players even with an index assigned to their products.
But a really interesting idea. Seriously. Both hands up.