I agree this is a concern, though more with phishing than social engineering.

An attacker site pretends to have their own "Login with HN" implementation, but asks users to put in a code generated from LoginWithHN.com itself.

If the user adds the code, then the attacker can impersonate the victim on any service that supports LoginWithHN.com (because of the special second-time login handling)

If the string was more explicit that it's for LoginWithHN.com, the victim is more likely to recognize that something phishy is going on.