"However, a study shows that motion sensor data is accessed by 2,653 of the Alexa top 100K websites, including more than 100 websites exfiltrating motion sensor data to remote servers."
Settings > Safari > Motion & Orientation Access to disable this for iOS. I think it's disabled by default.
Correct. It is disabled on a brand new iOS 12.2 install.
The option isn't present on iOS 12.1.4, the previous version.
12.2 is the release that mitigated this attack. So 12.2 also contains random noise in the sensor data - releases before this did not disable it by default (according to the article).