the thing you need to trust is that pressing that combination shows the legit OS stuff, that it can't be intercepted (Secure Attention Key).

how the OS implements what is displayed is irrelevant

windows has all kinds of virtualizations today, it can literally run web views in separate (invisible) VMs for security purposes