Well, good work looking into it!
But uh... oh neat, there's a critical override behavior... for... effectively an advertisement... great.
Rather concerning to watch what appear to be a bunch of GNOME devs rationalize opening up a very likely exploitable spear phishing vector because 'donating to a non profit is good.'
Welp, if/when that gets rolled out, I am guessing somebody is going to make some kind of extension or script that turns that shit off.