IMO web browser have been enabling all sorts of obnoxious behavior since before JS. One of my all time favorites were the sites that opened pop-ups in a loop faster than you could close them while an audio clip of a guy yelling "Hey everyone! I'm looking at gay porn!" You had to hit reset. Fuck the Web.
The web around the late 90s and early 2000s had some really sketchy stuff. I think the difference is that it used to be the sleazy underbelly. Now it's accepted as mainstream.
My local 'newspaper' website is chock full of scam adverts. The print version is dignified. The website people, somehow, turn a blind eye.
And I got an advert on Youtube this week using sexually explicit language to sell pills.
Feels like standards, and expectations, have really slipped.
Opening a popup needs JS though.
Not with the new popover API.
This doesn't look like it gives websites something they couldn't do before with CSS and JS.
I'm pretty sure it does but maybe I'm wrong, I had never tried to create popovers/popups using CSS. What's neat[†] about the popovers API is that it doesn't need any JS, you just write a couple of HTML attributes and voila, a popover/popup. They will run with JS disabled as well.
https://chrisburnell.com/html-can-do-that/
[†] Neat for me building things like tooltips and dropdowns into my web apps without using JS; not neat for annoying people with popups.