You're certainly not wrong about the malware / insecure code...
But a popup that opens an in-page modal vs a popup that opens a new tab or window are pretty much equivalent from a user experience point of view in my opinion. I don't want either, and neither is less or more evil to me.
At least the pop-up windows had a consistent way to close them and you could use keyboard shortcut. Now I have to think about the right way to close each custom popup.
But a popup that opens an in-page modal vs a popup that opens a new tab or window are pretty much equivalent from a user experience point of view in my opinion. I don't want either, and neither is less or more evil to me.