You're right. But something like this would be harder to fake: http://www.mozilla.com/en-US/img/tignish/features/security-i...
It's a pretty cool feature, but it means that on Firefox, attackers should be able to emulate basically any chrome they want to.