Alert doesn't lock your browser. The developer can spend a lot of time and effort to make an even more intrusive and annoying custom alert.

Why should I as a user have to endure instagram and twitter blocking content with a delayed login prompt that cannot be canceled? Because they can. Browser APIs or not malicious developers will be malicious.