There are a ton of use cases that demand it, so it was added a long time ago (around the same time as Fullscreen, I think). The current user experience for it (opt-out instead of opt-in) has likewise been around for ages. I think I remember seeing an explicit permission prompt very early on but they got rid of it.

"You could label that button anything" sadly applies to a significant number of dangerous things a website can do, pointer lock is not near the top of the list.