> I still don't understand why the highest entropy APIs aren't gated behind browser consent.

Simple answer: The makers of 3 largest browsers by market share (collectively 90%+) are buddies with the people who want to fingerprint you. Only the 4th largest gives a shit.