It’s not security for the end user It’s security for Google Back in the day, you could upload, for an example, a specially-crafted HTML file with your own mal

It’s not security for the end user It’s security for Google Back in the day, you could upload, for an example, a specially-crafted HTML file with your own malicious JS code to, for an example, an image hosting service and basically use them to serve your attack upload. You could more or less abuse any website upload form to host any file that that you wanted. It was bad. Browsers have drastically improved but why risk it? Using a separate domain makes a lot of scary scenarios completely impossible.