I'm a cofounder of https://clerk.dev and we've found we need to keep a close eye on this ever-evolving world of browser security models.

I think what OP has glazed over a little bit, is that authentication is a massive, thorny exception to their advice of "adopt the Same Origin Policy instead."

Consider these authentication use cases:

- Sharing sessions across mail.google.com and drive.google.com

- Sharing sessions across google.com and youtube.com

- An okta.com generating a session on google.com

- Persisting a youtube.com session even when youtube.com is in an iframe on example.com

All of these scenarios are reasonable, but it's a huge challenge to support all of them in a privacy- and security-conscious way.

That being said, I generally agree with the advice of "adopt the Same Origin Policy instead" after authentication is solved.