They won't get secure cookies [for the site they're attacking], though they could plausibly redirect the user to a similar-looking HTTPS domain under their control and get permissions requiring a secure origin.
True, but they won't get permissions that the user grants on a site-by-site basis, which also means the attack can't silently happen in the background.