Because a browser can't distinguish between a CPU-intensive app, game or simulation that you want to run in your browser, a cryptocurrency miner that a website runs in your browser after it explicitly asked you and you agreed, and a cryptocurrency miner running in the background.

Of course, they could start asking for permission before letting a site use more than X CPU, or before letting the site execute JavaScript at all, but most people don't want additional popups like that.

Someone said that Firefox warns you when a site uses a lot of CPU but I couldn't trigger that warning (maybe I didn't run it long enough or the feature is in a newer version).