Users do not always click yes reflexively. I filled in a form recently that asked "Do you consent for us to send you marketing emails" (default unchecked), and I laughed because I could not imagine why they expended engineering effort to ask that question and store the answer when almost nobody will check it.

It depends how the question is framed and presented. If the permission prompt is modal and the user believes that they will be prevented from accessing the application unless they click Yes, then they will always click Yes.

But if the website loads first and then they are asked for permission to load some additional feature, they are much less likely to reflexively click Yes rather than to press X to close the non-modal.

I think we can mitigate such problems like how we handled notification. We can just stop all fingerprinting and show maximum of two font in such scenario.