Here's an example:

// [ { url: 'https://example.com', width: 100 } ]
console.log(parseSrcset('https://example.com 100abcw', { strict: true }))

Which seems to be pretty surprising. Is it intentional?

The spec I've found says that:

A width descriptor, consisting of: ASCII whitespace, a valid non-negative integer giving a number greater than zero representing the width descriptor value, and a U+0077 LATIN SMALL LETTER W character.

"Valid non-negative integer" is defined as

A string is a valid non-negative integer if it consists of one or more ASCII digits.

It seems like the definition implies that the string must consist only of digits

Maybe it's allowed due to rules for parsing integers?