You're right, but that's not the point. A malware can change this flag on a hot computer and the user will not notice it when signing the transaction, that's the danger.