They are OK with it because it's behind an explicit permission dialog and the user has to specifically choose a single device to grant access. I doubt there's been a single instance of a real world attack using this API. It's been enabled by default in Chrome for years, so it's not like there hasn't been an opportunity. This is just concern trolling by people who dislike the modern web for other reasons.