Hmm. I couldn't find an indication of whether this requires Secure Context (ie only works with HTTPS or localhost) ?

Secure Context seems (coupled with the permission check) like it's an appropriate requirement here but I didn't see whether it's actually enforced, and obviously as an HTML attribute rather than say a Javascript API it might have been forgotten.