href substitution when handling the onclick event. Is this a browser security issue?

Question

JavaScript

Today I needed to make sure that after clicking on a link, its address changes to another one, so that when you click again, you can already go to it. And all of a sudden it didn't work the way I imagined it would, and could be a great opportunity for spammers, scammers, and other bad people.
Initially, the link itself looked like this
<a href="#mail">E-mail</a>
. A click on the link was processed with something like this code:

function email_clicked()
{
      this.href = "mailto:[email protected]";
      return true;
}

When I tried to click on the link, I found that the transition was already taking place at the spoofed address. That is, I click on one link, and it throws me to another.
This means that some bad person can make a link that supposedly leads to a safe site, but when clicked, it redirects to a site with ads or viruses. Googling on this topic, I found out that this loophole has been known since 2009. (This is somewhat similar to the situation with window.opener).
Question: is this (from the point of view of browser developers) a vulnerability, a bug, or is it "by design" and "it should be so, it cannot be fixed"?

Answer 1

That's what the onclick event is for, so that at the moment of clicking, handle this click as necessary. This is not a vulnerability, but a regular js code.
You can make a bunch of such links, but sooner or later such a site will be completely without visitors, and a couple of user complaints about a suspicious website (through a browser) will reduce its attendance to absolute zero.
So: yes - it's possible, yes - this is not a vulnerability or a bug, BUT - it's better not to do this and not mislead users.

Answer 2

This is how you put it "by design".

Answer 3

This is usually done by those who want to make money on ads for clicks