Why haven't browsers added built-in protections against this (or have they)? Exposing this timing data to arbitrary JS code via the DOM was a horrible oversigh

Why haven't browsers added built-in protections against this (or have they)? Exposing this timing data to arbitrary JS code via the DOM was a horrible oversight in the first place. I doubt any websites apart from interactive games actually need to time keystrokes. For those that do, an opt-in permission (like the camera/mic ones) would work.