I'm open to hearing examples of effective phishing prevention that cannot be replicated with open APIs like this proposal - or even the counterexample, phishing

I'm open to hearing examples of effective phishing prevention that cannot be replicated with open APIs like this proposal - or even the counterexample, phishing attempts that rely on freedom of client choice to do. I said "currently" - this means I'm open to hearing worthwhile exceptions, but I do want to have a chance to think about those exceptions and think of how companies would abuse them to in turn abuse their users, too.