No websites should be able to access anything on your hard drive arbitrarily.

Websites can ask the browser to store something in cookies, or local db storage; it can even say “here’s a file for download”. But it cannot just decide to place a download somewhere in your filesystem.

The browser itself is accessing your filesystem to read and write cookies, cache, etc. and the website has (rightfully so) zero control over that, other than asking permission and offering up a link to something the browser may to may not decide what to do with.