Pattern showing up everywhere:

Users thought they were authorizing an action.

They were actually authorizing a relationship.

Example: a “withdrawal” signature that moves nothing —
but permanently authorizes a spender.

Routine clicks → long-term exposure.