Anyone can request MIDI permissions.

The parent comment implies a bad actor using the API for something like fingerprinting, and a common user who may have never even heard of MIDI, let alone have a device.

But won't the user then go "why would I allow this website to access something I don't know about?" or, if they clicked yes anyway, the entropy would be ~0 as they have no midi devices.

This is assuming we moved to a model where more permissions had to be requested rather than just allowed

No, of course they wouldn't. You or I would, sure, but a regular user is pretty much conditioned to accept whatever to make the page load.

If they don't care about privacy enough to learn about it, that's fair, no point wasting your time to avoid a problem that isn't affecting you much.