The “legitimate websites” that disrespect privacy and security almost always do that in a way transparent to the user (ignoring the cookie prompts, but I don’t think that’s a fair comparison). For example, news websites could try and access my location info, but they don’t because there’s a permission prompt which would appear.