Behold, the worst part of the web platform: user gestures.
In short, let's say you've built a web application that edits maps, or… does something else, hypothetically. You implement file saving in that application using the fancy new native browser APIs. Then you have to do some stuff to process or load the file when you click Save - like if you're converting the file and you want to do it in a WebWorker for optimum smoothness. Soon, you will meet this error message:
SecurityError Failed to execute 'showSaveFilePicker' on 'Window': Must be handling a user gesture to show a file picker.
This is just one example of "user gesture" restrictions: you can also find them when you request permissions or attempt to open windows. Basically, to crack down on bad actors or misuse, the browser restricts certain functions to only being called in connection with a click handler.