Same origin policy is an important part of the security model so it is "on" by default for most things, but for the referer it does not seem to be so. The default for browsers seem to be no-referrer-when-downgrade
which in practice is close to "always on" I suppose as everyone uses TLS.
Probably same-origin
would be a more secure choice since it won't leak your URL's to the 3d party?
So I am wondering if there is any good reason for that?
My guess it is either too important for advertising or just was historically so and no one wants to change it.