I could be wrong, but it looks like they are doing a server-side redirect to their custom zoommtg:// URI protocol now instead of making a call to the localhost server. Couldn't anyone still drop this on their website and force you to join through a redirect just as zoom is? I don't see how that particular concern of the disclosure could be avoided unless browsers force confirmation, as Safari has done.