Then what about when Brave hijacked affiliate links en-mass for all users? No 'not required' as it was maliciously done in the background (until they were called out on it at least).

Brave is a shady platform at a minimum; and has been caught in the past being actively malicious.