I think it's always worth bringing up the risk of 'confirmation fatigue' in these kinds of discussions. Friction is not universally good for security. Too much friction and your users start blindly confirming everything instead of reading/thinking. This is already a problem with LLM tool calls (due to which, everyone seems to be pushing towards an 'allow all, with some exceptions' type model).
[flagged]
it took NIST a decade to realize that constantly making users change passwords for no other reason but the wall clock changed increased the use of insecure password practices.
It is indeed a world of reality vs what sounds good on paper.