Libvirt has no problem enabling -device pvpanic for all guests where <on_crash> is set to a non-default value, since the use of <on_crash> is a sufficient hint that the user expects the guest to be able to notify of a crash in the first place. But I definitely agree that it is more conservative to ask libvirt to always provide -device pvpanic than it is to blindly enable the device and hope that it never causes damage.
Changing guest ABI depending on <on_crash> is a much much worse cure than the disease.
Paolo