Or rig screens such that the buttons do not appear to be what they are. I've seen many a install-this-app ads where cancel isn't cancel.

The average user simply does not have the skill to determine real from fake and any heuristics to do so will be defeated by the scammers. You have to be able to understand what could be done with access, not what's "intended" with the access.