I've seen this permission prompt twice on the driveby web on sites that have no business asking for it. I wonder if it came through one of the ads on the page.

I think the majority of browser users aren't going to know what it means and given the training everyone's had clicking "allow cookies" they're probably just going to click allow to this thing they have no idea what it means.

I'm in favour of locking powerful APIs that are likely to be abused on the driveby web to being locked behind the site being installed and accessed as a web app.