Spearphishing is still one of the most common ways of breaching a corporate network. If I target you, you will likely fall for one of my attempts. If you are a company rather than a person, my odds go way up, because I have N chances to trick someone rather than 1 (where N is roughly the number of people at the company with email access).
This is one of those things that everyone says "Ha, I'm smart. I'd notice. You can't trick me."
And maybe you are. But you're also distracted. And that's my greatest advantage against you. All I need is to sneak in an unexpected Github prompt that looks completely authentic, and now I have your Github password. Wanna bet you don't have 2FA turned on, even though you know you really ought to? And even if you do, it's getting easier to social engineer your way past AT&T's lovely customer support: https://www.youtube.com/watch?v=caVEiitI2vg
Ok, what's the point?
This: Every character in the URL bar unrelated to the apex name is a deadly distraction.
Right now, how do you know you're actually on HN instead of some knockoff? "ycombinator.com".
How many characters do you have to read unrelated to that? "https://news. /item?id=17927972"
The most vital part of a URL for vetting identity is also, usually, the hardest to see.
Now, I don't know whether google made this change in order to assist with this. But it's one possible justification, and a step in a good direction.
We may not like it, just like we didn't like when Google removed the clickable "cached" links from search results, but in this case consumer protection outweighs our urges as a power user.