First, black hats hack into sites protected by HTTPS all the time. Requiring HTTPS does not protect you when the server is compromised. Second, XSS is not neede

First, black hats hack into sites protected by HTTPS all the time. Requiring HTTPS does not protect you when the server is compromised. Second, XSS is not needed to exploit devices on the other side. Third, users click/tap yes to just about any dialog, no matter what it says.