Isn't that the price of a relatively well sandboxed experience by browsers?

I've experienced the same limits building small tools for myself and friends that I wanted to contain in a single HTML file without external dependencies... but I understand why the same project without these restrictions could easily become malware, and ones that could be easily propagated.

I wish the browser would either allow local-only or internet-only, then only make up its mind after the first attempted request. Fetch an image from the internet? No script access for local files. Fetch a JS from elsewhere on the hard drive? No internet access. That could provide the sandbox while still being flexible.