Same origin policy is an important part of the security model so it is "on" by default for most things, but for the referer it does not seem to be so. The default for browsers seem to be
no-referrer-when-downgrade which in practice is close to "always on" I suppose as everyone uses TLS.
same-origin would be a more secure choice since it won't leak your URL's to the 3d party?
So I am wondering if there is any good reason for that?
My guess it is either too important for advertising or just was historically so and no one wants to change it.