This seems pretty sketchy, and I don't really understand what prevents a website from clickjacking.

The original flow is awkward, but also renders the permission element in a location that can't be clickjacked, thus offering some protection from geolocation.