Typically they do not allow anonymous access by default, but do not discriminate by host.

> That's not the way I've used them. Don't they usually default to sharing one directory and nothing else?

That's a good default, but historically speaking you had to chroot them to get that behavior. Nowadays you could use Docker.

> [Writing to files] is kinda what file system permissions are there for, and it is usually pretty configurable in the server, right?

Running a server that includes code to write to files is unnecessary for serving up web pages, and it's more likely to accidentally result in the server writing to files than running a server that doesn't. You're more likely to misconfigure a server that's pretty configurable than one that isn't. Filesystem permissions are generally far looser than you want for anonymous access over the internet; I don't want random strangers to read my /etc/passwd or see which versions of what Python modules I have installed, much less create files in /tmp. Filesystem permissions are only usable in the first place (for uploading files) if the FTP server has the authority to set its user ID to the user ID of the authenticated FTP user, which means it needs to run as root until after they've authenticated. Also it means I need to add my FTP users to my real /etc/passwd and /etc/shadow.

> is this relevant to something that asks if FTP is needed over HTTP on the protocol level?

My point with the two-kilobyte secure (?) HTTP server is that FTP is a bad protocol. The reason browsers should continue to support FTP is not that FTP possesses some kind of unparalleled technical excellence, the way NNTP and IRC could be argued to; it's that FTP, however janky it may be, is still useful, and providing better access to existing FTP repositories is one of the main reasons the WWW was created in the first place.

> If this was a priority then I'm guessing that over the last decade or so getting ftps or sftp working in the browser would have been worked on.

There's relatively little advantage to ftps or sftp over unencrypted FTP for anonymous access—you aren't sending the FTP server any files or credentials, just the names of files you want—and no advantage for backward compatibility, since the existing FTP servers you want backward compatibility with aren't running ftps/sftp.