Earlier today I wrote you a long answer that seems to not have gotten sent... Here I go again.
If we're used to tapping the confirm button without checking what is bone done everytime, then we're screwed. Specially if we already have the active key in our steem keychain or even worse - if we have permanently authorized it's usage for that particular website. Sure, there's the possibility I'm cautious enough, but it would still surely succesffully scam some people.