The people most likely to be actually harmed by this are developers, right (i.e. pasting in to a terminal)? And shouldn’t we of all people understand that there isn’t much practical difference between opening a shady website, and running a shady executable binary? And if pasting straight into your terminal then there literally is no difference whatsoever.

Aside from shady websites, the other main attack vector would be, e.g., a XSS vulnerability on Stack Overflow. And browser vendors do seem to take XSS very seriously, and there are a number of ways to mitigate those.

Scummy news site injecting social links in to copied text? That to me sounds like a people problem, not a software problem.