The threat model seems to have 2 requirements: 1. Only if the top level url bar says zoom.us is it allowed to cause any noticeable change to the zoom native ap

The threat model seems to have 2 requirements: 1. Only if the top level url bar says zoom.us is it allowed to cause any noticeable change to the zoom native app. This means some arbitrary website cannot cause any noticeable change to the zoom native app without redirecting you to zoom.us . This also means that a sandboxed iframe, such as an embedded web ad, has no possible way to cause a noticeable change to the zoom native app, because it is not able to do top level navigation to zoom.us . 2. When the zoom native app is triggered, the user must click yes on a confirmation button before joining the meeting. I don't see people advocating that you need to be logged in to zoom.us . Achieving requirement 1 without requirement 2 is still bad, because some website could redirect to zoom.us and force you into a meeting. Achieving requirement 2 without requirement 1 is not too bad, but is annoying, because some sandboxed ad in a website could cause the zoom native app to pop up, annoying you, and could maybe almost be a DOS.