It seemed odd to me that a Web site could write to or read from the clipboard without the user approving it

Yeah, that’s a security hole that I hadn’t been aware of.