Cheers! I am the developer of IC-SIWE and IC-SIWS (developed outside of my DFINITY employment). A short first comment from me at this time, I might return for a longer post later.
In general, treat signing in with an Ethereum or Solana wallet as you would treat username/password logins. That is, just like on any website that uses username/password, there exists a phishing risk. A malicious website looking like the real one can always trick you into sharing your credentials and then misuse them. That is why companies like Google and Facebook employ a whole host of mitigation strategies to avoid this scenario. For instance, Chrome, the web browser, maintains a blocklist of malicious domains that have similar domain names to the Google account services. Most modern web services that accept username and password as a sign in method quickly prompt you to upgrade your security once you have logged in. This type of hardening should be performed when you use sign in with Ethereum or Solana as well.
In practice, the only sign-in method I’m aware of that fully mitigates this type of phishing risk is passkey authentication.
The core issue is establishing reliable assurance that you are interacting with the correct domain. With passkeys, that assurance is handled by the browser and operating system. The passkey is cryptographically bound to a specific domain, and you rely on the browser and underlying platform to enforce that binding and prevent it from being used on a spoofed site.
When using Sign-In with Ethereum or any authentication method other than passkeys, prompt users to upgrade their security after logging in by enabling some form of two-factor authentication. That makes phishing significantly more difficult.