[lobsterthief]

But websites don’t

[pests]

They only get access to what your browser gives them, through a file picker.

[esrauch]

It can actually be both.

At least on Android the browser itself can lack the rights to listdir and only gets access to file you picked via the system picker, rather than the browser having unlimited access and only delegating only some of that access to the Web app.