Why is this considered acceptable?
It's not considered acceptable by everyone. It's a poor compromise between privacy and utility that is seen by many as a historical mistake.
In other words, why isn't the Referer header subject to a cross-domain policy?
Also significantly back then there were no cookies. So if your browser told site A that you had come from site B, there was very little site A could do with that information. It could not spot a previously-planted cookie to tie up that referer information with anything else it knew about what you had done in the past, and it certainly couldn't let third-party cookies spread that information to generate a long-term cross-site tracking profile like the Googles of today do.
It was only when the feature set of the modern 'webapp' came together, including scripting, cookies and frames, that it became obvious that
Referer was the wrong thing to do. If it were designed today we would at most have something like the modern
Origin header from CORS, which has the slightly-more-privacy-tilted compromise of a site name but no path/query.
However enough web sites (unwisely) rely on
Referer that a single browser manufacturer can't easily disable the feature without negatively affecting compatibility for their users. This makes it very difficult to ever fix.