> So, it'd be hard to pull off such an attack.

That's what you'd think, but people rarely pay that much attention. The fullscreen prompt only shows up for a few seconds.

For example, recently a family member clicked on a fake YouTube link from an ad in Google's search results. Clicked the search bar and it immediately turned their whole screen into a "call apple support" popup.

They called me up because they thought it was a virus, but really it was just a fullscreen webpage, and being not very technologically inclined, they didn't even try Esc, Cmd+Tab, Cmd+Q, etc.