I think it's incredible that most of the comments here seem to accept or even defend that this is just the way things are, even explaining all the ways they wor

I think it's incredible that most of the comments here seem to accept or even defend that this is just the way things are, even explaining all the ways they work around it, rather than considering that this is a serious browser security issue and violates the idea that software should generally do what the user expects.