This element has an autolocate attribute that will request permission automatically, plus it doesn't supersede the JS api, it simply provides a declarative alternative to it, so sites that follow this negative pattern will keep doing so.
At the same time, there is no reason to not implement this pattern today and require user intent prior to requesting the permission