First, the header must be added to the response, not the request.
Second, in many environments (managed hosting etc.) there is not an easy way (or indeed a way at all) of adding headers to responses.
It's getting better. Most serverless hosts (including Cloudflare, which this site uses) follow the (req: Request) => Response pattern, which by definition allows sending headers.
Oldschool shared web hosting was a shockingly deprived environment by modern standards, which is why my Linode account turned old enough a few months ago to buy a drink in a bar: $20 a month in 2004 was amply worth gaining a degree of control over web server configuration which is broadly the default assumption now.
Since I was also administering some shared web hosting in my own right at the time - partially overlapping with my web design work targeting shared hosting, since some customers preferred to BYO - I don't blame admins for being difficult to work with; we all had good reason to be, with the afterthought security typically was everywhere in those days. But you begin perhaps to see why bypassing the whole rigamarole with a hint to the client was attractive.
I realize you're probably not accustomed to being called on your lousy behavior. I doubt you will need to become so. But just for once, here we are. You don't bother to find out what you're talking about before you speak and then you want your hand held on points that were already clarified, had you but bothered to catch up. I don't tolerate that in candidates, I won't tolerate it in colleagues, and I see no very pressing reason to tolerate it here.
And it doesn't allow overrides in dotfiles since that's not performant or secure.