That's technically correct, but as far as the security of the website is concerned example.com, example.com/~eviluser/uh-oh, and example.com/nefarious/sub/directory/pretending/to/be/google.com/ are all exactly the same. The issue Google are trying to "fix" is making it more clear that the domain the user sees is what they're really looking for. If a user on a website is being evil it's up to the website owner to stop that, not Google. Google are trying to protect people against evil website owners (or so they say...).