"web browsers already do this ;)" isn't a good comparison.
Actually, no Deno webserver I've written gets fs access. Some only get --allow-net.