To begin
The delay costs more than the mistake
Almost everyone will click one day: making the click feel natural is the attacker's job. What separates a minor incident from a major one is not the click, it is the time that passes before the alert. An alert raised for nothing costs a few minutes; an alert raised too late costs your structure days of work.