Right, that’s why you get a simpler yes/no dialog for notifications, and a conplex “navigate to this settings pane and click a separate button” flow for a keylogger

Depends on what you allow and what your level of sophistication is.

My mother recently had "There antivirus notifications taking over half the screen, do I need to click on them and renew Norton?"

She'd been somewhere and done something that had allowed an unscrupulous site to flood her with alerts directing her to give payment information to a scam site pretending to be antivirus renewal.

When I finally got over there (she doesn't live on the same continent) I went in and disabled notifications on all of her installed browsers.

As far as I'm concerned the whole 'let this website notify you' feature is an antipattern and yet another example of browser overreach.

Notification requests add to decision fatigue, which can lead to bad things.