> Now you're on a website that looks like the one you expected (if the third party has done its homework) but is completely in control by the third party.

A simpler attack would be to for the third-party attempt a login on their end into your account, and if you happen to click on the Magic Link generated by their login attempt, you wouldn't be signing yourself in, but them.