> An attacker could easily make a fake site

Or hack into the legit sites themselves if their cybersecurity practices are subpar.