... so how does it?

Edit: saw in another comment that it's hardcoded, so it was coincidence. That makes sense.

In Chrome beta 74, the count is in the bottom toolbar, so a variant of this attack that were UA-aware might have an even easier time. (The padlock is no longer green, either, and the leading https:// is omitted.)

On the other hand, scrolling to the very top of the page reveals the original address bar.

A possible mitigation would be to use a custom background or gradient for the bar that a web page can't guess. I'd be tempted to suggest the Google account's picture (if Chrome is logged in), but I don't know how safe that is from cross-site shenanigans.