Yes, that's the expected behaviour.
I'm intrigued that anyone would try and make a contribution with cookies disabled - presumably they are (justifiably) concerned about privacy on the internet, but there aren't going to be many donation forms that work without cookies.
The reason you need cookies enabled (with civicrm) is because some of the form state gets saved in your session which is tied to you via your cookie(s).
Here's an equivalent issue in Drupal from 16 years ago that's still going. The proposed solution is to provide some notice to users that don't have cookies enabled.
Options going forward are:
- Build yourself an extension which pops up a warning when a visitor to civicrm has cookies disabled.
- Create a PR for core to do this.
- Use an existing drupal module to do the same thing.
I'd recommend you start with an existing Drupal module and see how it works. There will be a few different ways to do this, some more invasive than others. For a core patch, I'd only recommend that it pop up after an attempted submission because otherwise you're generated some extra load and risk messing something up.