I feel this is a failure to capture/model the different use-cases between:

1. Copy file from A to B

2. Publish file to a public realm

If Google thinks that the average site cannot be trusted to indicate/clarify the difference... Well, that's fair, but (as the blogpost says) I'd rather see some browser permission thing like: "Can this website see original filenames and GPS data inside any media you upload?"