Most sites (IME) do it by accident. The API as designed is a footgun, so much so that there’s an active proposal which would basically replace it. (I can’t speak to how much better the replacement might be.)

Obviously it can be used intentionally to hijack your session history, but it’s also surprisingly easy to do by mistake unless your state management is effectively designed for concurrency (which the API isn’t, but it encourages the same kinds of bad patterns).