I guess it is because of some legacy sites that would break. Cross-domain interaction rules are very complicated and poorly designed. For example there is no CS

I guess it is because of some legacy sites that would break. Cross-domain interaction rules are very complicated and poorly designed. For example there is no CSRF protection on the browser side and every developer has to implement it on the server side. Some of the things that would break without third-party cookies are social network widgets - you would be unable to like some post or add a comment using Facebook login on a third-party site.