Maybe because me clicking some link and getting loaded into a site is in no way a tacit agreement to be exposed to security concerns? I don't owe the creator of a site anything by default.