It is important to know audio does not go through MIDI. MIDI is a transport for commands that can activate audio. A literal example is you have a musical keyboard that makes no sound. But it is plugged into a box that makes sound. So the keyboard passes commands to activate the sounds and can control of the notes, tone, octaves, etc. This transport can send (out), receive (in), or pass (thru) these commands. Take note these are specific commands and not really actual code.
What it cannot do is pass audio especially audio associated with a video. So unless this is a site in the realm of sending these commands to make sounds like an online synth or maybe even a music guide site I am unsure what is their intentions for using this.
It is also possible this is a poorly created site and was implemented on accident. Chrome will request access to MIDI devices regardless since the API is called.
While I know of no current exploits using this feature there are two previous CVEs I am aware of. CVE-2015-6792 and CVE-2015-6765 could both do a denial service attack, crash the browser, and possibly achieve arbitrary code execution outside of the sandbox. However both require older versions of Chrome such as 46 or 47.
So your intentional risks are you can have commands sent/read to connected MIDI interfaces. But the commands should be specific and not harmful in them self. But you are still allowing commands none the less.
The intentional risk could be an issue if you have your computer keyboard set up as a MIDI controller and the site reads these commands. As a result, it may act like a keylogger. However it won't send characters and will send commands like 1111111 or 7F and neither will correspond as the letter and number you pressed. But theoretically if the attacker knew how these were mapped out on your keyboard they can be crossed referenced and translated to what you typed. This is a highly unlikely scenario though.
Your unintentional risk is an exploit like the previously mentioned CVEs taking advantage to run any code. This is a risk you take with any use of a browser feature that accepts input from a site though.
Overall there is not enough information to go by to tell if this is a legit use of this API. You will have to use your best judgement if this functionality is required for your purpose of the site and how well you trust this site as well.