Yes, one could. Also, the security issue. Those badge sites required an nsec, the login with plugin didn't work. That's a perfect way to honeypot everyone. There are many issues.
Discussion
You can read the code or run it yourself if you are worried my site is a honeypot https://github.com/verbiricha/badges