I think everyone is forgetting that there’s TLS on almost every website. You can monitor where people go, but you can’t see the traffic unless you get the person to install a malicious certificate in their device.

You can however have your traffic redirected to a lookalike site where you give up your account info. So there’s still some actual risk.