If they do it right, I imagine the source of the event would be tainted, so that only an actual click received from the OS would be allowed to propagate through

If they do it right, I imagine the source of the event would be tainted, so that only an actual click received from the OS would be allowed to propagate through. I'm sure it's tricky to ensure this, though. Like pop-up blocking.