This is also why there’s such a a prevalence of flashing warning banners, fake pseudobluescreens, and other scary shit disguised in chrome notifications.
The notifications in chrome are as close to on by default as you can get and with the right code snippets you can make it look like the FBI locked down your workstation and you need to call them.
Firefox should start hardening against this behavior now because popularity gets targeted even more specifically.
Make it an end user safety feature.
Force every notification to have
“This is a notification from a website that you elected to receive by allowing notifications. You can disable these notifications here”
with a link to the setting on the frame of of every one, no fullscreen allowed, no flashing, double-check and prohibit the words FBI, CIA, NSA, TSA, IRS, Social Security, Microsoft, etc.