I don't really know how much this matters, but the SDK header has `_In_` / `_COM_Outptr_`. There's no public IDL to compare to, but I think we could add the attributes there as well.
Those are SAL annotations, they basically are used by Microsoft's static analysis tool. I don't think we've cared about that in the past.