Just because you invent a special type of escrow contract that makes it harder to steal money doesn't mean an attacker would use it... he would just instruct users to send money to his own contract and bypass all of the protections you've invented.
Legitimate ICOs should take on use of these widgets and contracts, educating users in the process to only send to particular contracts. This requires a great deal of improved hygiene for ICO providers and education for consumers, but there’s no easy foot forward here.
So yeah, we definitely need improved hygiene that addresses the pain points of trying to do these funding events through a blockchain.