> You think the average user is going to explicitly whitelist

When prompted by the browser on first login/signup, yes, the same way the password manager works. With stored passwords, keeping the login cookie doesn't even add much value.

What about the other 200 unskippable prompts you get just by opening the website?

Well, there is a skip button. It's labelled "accept all"