Hacker News Reader

Which has policies that can be enabled to block it if necessary

Users click "accept" to make things work.

Filesystem access is going to have nefarious consequences.

That's not how policies work. Schools, organizations and even home users can enable policies to block this feature altogether as well as many others:

I'd like to see that ordinary user that is configuring API usage policies on their home network