Comment by runako

This doesn't really address the issue here. The condition here is that a site might decide that it needs to store (say) a copy of the Red Hat server installation package on each user's local machine (20GB) to facilitate repeat visits.

The stored data is not related to the user at all. The problem is that the website gets to silently write 20GB to the user's disk.