Can you load, let's say maps.google.com/somepage in a hidden iframe and use postmessage to send location data if it already has access? Or do browsers force top level navigation for such permissions?
There were probably covert ways to obtain the same information but it's now easier for Google to grab the information using regular APIs.
It also means if app X and app Y on their own subdomains were previously using location APIs without any tricks, you are now effectively opting into both apps.
Bottom line: technically it doesn't matter but it probably makes a difference in practice.
Browser could implement finer grain permissions (i.e. only permit the API use for a given top level path regexp) but I bet most users won't bother fine tuning their grants.
