As with most things security, people tend to be the weakest link in the chain.

This type of issue could be solved in a lot of ways. I think a solution wherein:

1. ICOs use a standard 'escrow' contract wherein ether and coin get held by the contract for 7 days or so before either party can withdraw the opposite pair (where either can back out).

2. Building some standard 'ether address' widget that verifies the type of contract an address is. A user-wallet would usually be a warning sign.