> Pasting into a terminal is interpreted literally, meaning an attacker can hide ;sudo do $really_evil_thing; in innocent looking, pasteable HTML with CSS trickery. Therefore, we can’t blindly paste text into a terminal.
It depends on the probability that an "attacker" has done such a thing, which depends on the website among other things.
Sincere question: is it really appropriate that so many of us think in such black and white terms about security? I submit that it is not appropriate to strive for zero-probability-of-being-pwned solutions in all personal computing scenarios; there is a cost benefit analysis always.