It can be done only after the user confirms, that they want to allow the website to do it (similar to a webcam access, etc).

Not without permission, for sure. I dislike how some websites will add extra text when you copy.

if this is important to some users (to me it is) why blindly trust an application's claim of what it does without verifying/restricting it[1]? The IMHO logical step for a user (again most don't care) would be to sandbox the application with a precise set of calls that are whitelisted and judge the application not based on trust but based on what they allowed in their security controls (firejail, apparmor, seccomp, SElinux, ...) and so immediately see if they did something different (that breaks the promise/trust)? (even then browsers have million lines of code so even with best intentions ymmv)

Reading/writing clipboards is a problem for sandboxing since they act as a bridge to another layer that otherwise has no contract or understanding of the application. So are many other features not just on browsers but on any application that for some reason needs to handle a gazillion tings (on Linux subscribing to system/user dbus messages is a big issue and out of the box totally unmitigated).

[1] If a monolith like chrome/firefox needs to understand/parse hundreds of protocols, technology-standards, etc, is a challenge to sandbox, maybe it isn't the sandboxing but the application that is the wrong tool for the users threat-model? Note, there is also Tor/Tails/QubesOS if isolation between user-space applications is a serious concern.