I think that's a valid concern. Stuff like this should only be allowed after a prompt where the user explicitly allows it, just like any other permission

I would say it’s even more important in the case of a web app that stores data locally, because it’s imperative that the user understands that data is tied to that particular web browser and device, and that clearing site data (which I’ve known non-technical users to do periodically to reduce tracking footprint), changing devices, etc can/will result in data loss.

Oddly enough the handful of web apps I’ve known to use local storage don’t communicate this at all. Developers seemingly treat data in browser local storage as existing indefinitely and unlikely to be deleted, when in fact it’s probably the most easily accidentally lost form of storage an app can have.

Yes, send all your data to someone’s server instead.

If you're concerned about a web site silently having access to personal data from your phone, surely it doesn't matter whether that web site is storing it silently in your device's browser storage, or storing it on the web site's servers.

If, on the other hand, you're explicitly uploading or entering data on a web site, well then yes, the default assumption would certainly be that the data is getting saved on the web site's servers (if it's being saved at all). That's how the web has worked for a very long time, with the exception of cookies and a few other more recent but not widely known storage mechanisms which in most cases aren't considered sufficiently robust for persistent on-device storage.