Posted recently that I think these forms should ask permission via the browser (in the same way that websites ask for microphone or video permissions).
And then you can just put block all as default.
But.... that would fuck with Google's main source of income so unlikely to happen.