I think this is an important point. The fact that you can change the href after the click is irrelevant because there are other (just as easy) ways to change where the link will be taking the user. If malicious javascript is being run on your page, THAT is your problem, not the href switch.