Details
On the precompile configuration file, both Sha3FIPS256 and ECRecoverPublicKey have the (AcceptDelegateCall, CallableByContract, CallableByPrecompile) filter. AcceptDelegateCall allows the use of DELEGATECALL opcode, which might be an issue in certain cases (see here).
While Sha3FIPS256 and ECRecoverPublicKey do not alter the state, I believe this shouldn't be a problem, but other chains do not use this unsafe filter for both, see for example on tanssi where they use only (CallableByContract, CallableByPrecompile), so as an extra safety guards it might be better to use the previously mentioned filters instead.