I guess someone thought it was a useful addition (e.g. since on smartphones nowadays communication between apps is through launching of URLs, e.g. loading the URL "https://maps.google.com/...." would open up the Google Maps app), but they didn't consider this exploit.
maybe devs just dont care?
maybe they tend to believe "who would inspect our page and try to manipulate form?? no one"?
maybe lack of review?
lack of time?
too much context switching?
Notice that the user is still required to actually press Send in front of their default mail client with an open window showing the full email and attachments.
(Addendum: See spacebar heating macro XKCD.)
Our users want to be able to be able to open a declaration and email the documents, either internally or to their customers, along with some message.
We don't really want to implement a full email client in our program nor having to deal with their SMTP server setup, including proxies, firewall and so on. So we basically do exactly this, open a new mail in their client with some template text and with one or more attachments.
We use MAPI though and not "mailto:", but use-case is there.
(A mail-client could contain basic "warn"-lists of credential-holding places, containing a few dozen file names covering 99% of current platforms/programs)
And some "advanced" config options to also configure allowed URI schemes.
> A mail-client could contain
but it doesn't.
Sadly we have the year 2020 and as Rick Cook said: “Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning.”.
If the email program would pop up a warning that says "The following files have been automatically attached: [List of files]", would that meet the security concerns?
I don't want my email client automatically attaching files from my computer, period. I don't care how well or poorly it displays that fact. There's no use case important enough to warrant that kind of intrusion.
Or a letter you're typing, to some company: in your word processor, File -> Send as E-Mail.
For these features to be able to work, the email client would need to have an API so it can create an e-mail with attachments directly attached.
Sure they're not important, but they're convenient. You might not like them, but hey am I glad you're not a product owner of a mail software.
A moment's thought should illustrate that "pop up a dialog box to ask permission" isn't really a fix for a hole like this. It has conspicuously failed in the past.
I think your quote, which has the benefit of being funny, does miss one key thing, and it's that the number of users and our interactions with our systems keep growing.
Prob(user error) might well be increasing a bit, but N * Prob(user error) is definitely increasing.