They should both pay a bounty. But if you had to assign blame only one place it would be ECMAscript. Setting the value of an unintended cookie should not be so easy to do by accident.
That's it. That one property.To add cookies, modified cookies, delete cookies, whatever, you do an assignment. To read all the cookies, you do a read.
That's it. That's the API.
One more thing: Cookies are limited to 4KB total due to the HTTP/1.1 specification.