People with less experience normalize that behaviour and when the domain is not trusted the habit let their guard down. See all the clickfix attacks.