> So websites can now nag users to allow access to the root of their local disk
No, Chrome doesn't allow this.
Here's a simple demo: https://output.jsbin.com/kekekac/quiet - note that you can't select root, Downloads etc.
Ah yes, totally secure. I’m sure there will be no unforeseen problems or bypasses.
In this example
https://web.dev/patterns/files/open-a-directory
I can select Downloads