Because the protections already exist. The existing same-origin policies already offer sufficient protections for "not having the browser commandeered". The onl

Because the protections already exist. The existing same-origin policies already offer sufficient protections for "not having the browser commandeered". The only reason this exists is because bad _local network_ implementations are _common_, not that they cannot be made secure just like those on the Internet. The example in the W3C doc (https://wicg.github.io/private-network-access/ https://wicg.github.io/private-network-access/) to justify this is an instance of a broken server implementation. It's using a GET request to set some value even when GET should not have side effects. It's a common vulnerability but its totally the server's fault here. If you have your pants down at home and someone happens to see you naked through your window, it's on you. The solution should be to close your curtains, not "make everyone wear glasses that automatically blur any open windows".