Me too but I'm glad it does now and I don't have fear (web) apps that exploit the accelerometer as microphone.

It was useful an API to detect if a client was faking their user agent or was a bot. When I worked for a neo bank we abuse all the APIs to detect if client was a real person or not without having to use captchas.

Yeah you could use the vibration API and accelerometer API as a very low bitrate TX/RX system for devices on the same table and close enough.

No permissions required.

I vaguely recall there being some early-days accelerometer-based webapps that absolutely destroyed batteries, because the high-resolution accelerometer checks required responsible throttling / debouncing. So gating it behind permissions makes some sense to me.