Someone else mentioned that cloudflare uses the webaudio for verification challenge, but only triggers it briefly.

Ugh... Seems like we need an audio API web permission, or maybe do something like browser already do for some of the other APIs and actually require API users to actually play something or display a warning/play an annoying chime otherwise.