Even the earlier methods required JS to be able to trigger requests not explicitly intended by the user. And at least they usually fired up a loading bar at the

Even the earlier methods required JS to be able to trigger requests not explicitly intended by the user. And at least they usually fired up a loading bar at the bottom of the browser, so you could tell shenanigans were happening. AJAX made that cleaner and broadened its use, but yes, you could already make requests with Javascript that the user didn't want you to or didn't care to make for any purpose of their own.