Never is a silly standard to measure against. I'm clearly not saying don't do it at all, I'm saying that this approach won't succeed at anything other than mak

Never is a silly standard to measure against. I'm clearly not saying don't do it at all, I'm saying that this approach won't succeed at anything other than making developers feel like they're Doing Something™. Actual spam filtering and 2fa are examples of real security, showing users the URL is an example of security theater. The corollary is the nonsensical "security is hard so let's force non-technical users to do it".