Oh come now, that's putting the onus on the user who might not know the first thing about headers or browsers.

The refer(r)er header is a relic from a distant past when the internet was a very different beast, and when people had very different concerns.

Then the problem is the browser makers enabling referrer by default, not my Webserver looking at it. Is looking at the user agent string immoral surveillance too, because most people probably don’t know that exists either?