To be fair, you're supposed to get a permission dialog and it seems you have to pick the specific device(s) to connect to them.
https://web.dev/usb/#get-access-to-usb-devices
However I suppose that the mere existence of this API means that there could be a way to bypass the request; The browser already does have full access to every device.