In many cases I think the question is more "what functionality would the web browser need to break to prevent pages detecting X, and is that worth it?".
I remember doing this kind of detection years ago for an (entirely benign) chart authoring webapp; you don't want to offer a font for client-side rendering if the client doesn't have it. You can generally assume that the `monospace` and `serif` fallbacks are different, so if you have one layout box with text in `font-family:FontToDetect,monospace` and another with the same text but `font-family:FontToDetect,serif` and they both come out the same width, it's good odds that the user has that font. [EDIT: originally got that backwards due to brainfart]
Nowadays the existence of `@font-face` makes that particular problem mostly obsolete, but the same general principle applies all over.
AFAIK webUSB was always behind a consent dialog. That attack was based on getting consent, and the authors seems to say so at a talk about it (or a similar attack): https://www.youtube.com/watch?v=pUa6nWWTO4o
It's still very bad, but not nearly as bad as you say it is.
Sure, drive by ad tracking is easier with the web, but fingerprinting through desktop apps does exist.
Basically, why should I be forced to download a program that gets more access than a web app gets? Just so privacy advocates feel better about averting another privacy leak that can be prevented by browser permissions (like the webcam is)?
And as a developer, why should I be forced to learn Qt/GTK so I can do something like USB? And if I use Electron, I’m skewered by other developers for writing a bloated mess because I had no choice.
Look at this site which looks at the fingerprintable bits of data that is available from a web browser: https://amiunique.org/fp
The web browser leaks a lot of specific information about the user. Which can then be combined with other information to uniquely track a user on the internet.
Why does the web browser need to make available the list of all fonts on a user's machine? Installing any combination of extra fonts makes you significantly more unique.
Same with GPU model.
The article talks about WebUSB. And how it was used to phish people's Yubikeys:
https://www.wired.com/story/chrome-yubikey-phishing-webusb/
The user isn't consenting to that.