Unless I'm misunderstanding something, I don't think it can. Your ownership of NFTs and ETH balance is public info on chain, and the site can construct a malicious transaction giving them away, but it ultimately has to trick the user into signing it. Not really sure what leeway they have to manipulate how the wallet UI presents the tx to the user though.
Metamask presents a big red warning when it requests a signature for a hex ETH transaction. But most people don’t read. Or they request token approvals users don’t bother to modify.
What an earth does that even mean? It's no wonder people keep messing this up. You need to spend half your life keeping up with the tech just to not get scammed.
I'm guessing the confusion is the "hex ETH" part. I know what a digital signature is and I can guess that ETH = ethereum, but have no idea what "hex" means so I can't "keep up" with your comment either.
I believe the malicious tx is basically serialized into a hex string, so not easily inspected by the user. As such, the wallet gives a warning, which the user ignores