Some of that hijacking is done by various front end JS libs, I've seen sites/projects where that kind of thing was happening and none of the devs weren't even aware it was part of some "batteries included" toolkit.