Apple has the ability to remove apps which abuse their permission requests, e.g. by lying to the user about what they are going to use the permission for.

Not so with websites. The bar for including new functionality in browsers is way higher than it is for native apis because there is no way to police abuse.