[Zak]

There's already a restriction that requires going into the settings and flipping a toggle, with a warning. I think that's enough.

To be clear, enough does not mean that will stop every trojan/scam. People send Starbucks gift cards to callers claiming to be from the IRS calling to collect overdue taxes despite the obvious absurdity. Enough means that someone who doesn't know anything about computers but who reads and believes the warning label has sufficient information to know that it's a potentially dangerous decision. Some people will make the dangerous decision anyway, but it's on them at that point.

[IshKebab]

Yeah, but scammers know how to talk people through simple toggles like that. Adding a 24 hours delay is a great way to ruin their scams because they obviously can't keep you on the phone for 24 hours. They have to say "I'll call back tomorrow" and then that gives a chance for people to stop and think or for other people to intervene.

Neither approach are going to be perfect of course, but I would expect the current system to be nearly useless and the 24h delay to be very effective, and it seems like a very minor inconvenience to most users.

(All of that is caveated on this not being the start of a slippery slope, which I wouldn't bet on.)