> I still don't understand why the highest entropy APIs aren't gated behind browser consent.

Last I checked it's because it was generally considered that preventing fingerprinting is practically impossible anyway. It's not like you need a lot of entropy for fingerprinting, and the web API surface is enormous. To actually stop fingerprinting you'd need to make your web browser more or less useless.