No, they don't just "Find an obscure setting". A website tells them exactly where to look, exactly what to do, and they have motive to do it because they want whatever this app is promising. These kinds of scams are all over the place.
Open up your browser's developer console while on Facebook and you'll see FB's desperate attempt to get you to not start typing in commands.
When Epic got up in arms about Google's fees, they published a sideload-able version of FortNite, and some users ended up installing a fake virus-laden version (https://www.theguardian.com/games/2018/aug/10/fortnite-on-an...).
How many Linux users run arbitrary shell commands they find online while trying to fix or install something? What about some curl command somewhere that downloads and executes whole scripts? And Linux users tend to be very technically oriented.
This is not FUD. We're there. This is happening today.