And article is ignoring that the site can then add https and do that fullscreen attack anyway.

A better solution would be to keep showing a message telling you it has gone fullscreen like browsers currently do.