The remaining 25% hide under the disguise of generic security "concern" that usually involves tangential topic.
Case in point:
A: WebUSB has privacy risk, it can fingerprint you.
B: But it already require user consent.
C: ProcesD to pontificate about good user consent UX.