It does not seem impossible to anyone who has watched someone use a computer for a few minutes... A bright green button from google pay saying "click here to secure your interest in this car" is easily mistaken to mean "save to my interested list" rather than "place a deposit on this".

We know how hard it is to even find the download button on a website: https://www.howtogeek.com/how-to-spot-the-real-download-butt...

You're right

We like to pretend that we are immune to that, but we've all made similar mistakes.

And there's an entire Internet of websites trying to trick us.

It's sad, but you need to browse almost any site assuming the company is an adversary. I register my domains through two decent registrars but I recently needed to help a client through using GoDaddy and NetSol. The up-sells and cajoling were relentless, vile and eye-opening.

To be fair, Amazon one click purchases got me once. The principle that no one button should cause a "dangerous" action (i.e. one where you can't escape or undo it easily, and especially with money and data) is sometimes violated when the action is only "dangerous" to the user and beneficial to the provider.

Usually the result of clicking such a "dangerous" button is the user gives the provider money or data. It's not common that the provider makes it easy to one-click-no-confirm a process that gives the user money or the provider's data.