it does ask for permission, but a malicious website could ask it for a valid reason and then brick it, yup. On the other side, a controller should not be brickable via HID commands...