1) First off, the reason that people have to log off and back on is because the security system builds a local list of the person's aggregate permissions when they login.  This way, the client does not have to run a SQL query every time SF asks the user if a certain permission is granted; they're cached on the local machine.

2) The notification mechanism would require that the user query the server to see if they need to log off, which would be a performance impact; or the security system would require an application server to send a message to the clients, which just isn't feasible.