> In other words: this is all but impossible to impact regular users, and it requires a particularly careless developer to be hit by it.

Have you ever worked with someone who barely knows how to use a mobile phone? They will hand their phone over to someone they barely even know to do something they don't understand. They will follow instructions from a stranger over the phone, without understanding what the phone is warning them about.

I have worked with such a person. They did have someone walk them through a dubious process. Thankfully they realized what was going on before the process was complete, but who knows how much damage was done by the initial steps.

There are legitimate security reasons here. Whether there are reasons beyond that is an open question.