Bonus points if this results in mis-clicking something dangerous or irreversible, like "delete", "cancel","post","send", "close", "exit without saving" or the like.
In the same way that browsers refuse to do certain things unless coupled with human input (like open a pop-up window, or submit auto-filled form data), they should refuse to send a click event to an element that hasn't been stationary for a short while.
It would need to be defeatable for "game mode" though, for games involving clicking moving targets. Any other edge cases to consider?
This is why most platforms provide both raw and semantic events: mousedown and mouseup are instantaneous and reflect the raw input, but click is meant to describe user intent to initiate an action. Leaving the raw events for games but requiring semantic events for dangerous actions seems like a decent compromise.