And at $Corp I get constant popups to enter my password or confirm an action. Like 50-100 a day.

I bet threat actors are just salivating at the thought of giving you a fake password prompt.

Yeah. I am very hygienic at work in terms of what sites I visit but you can never be too careful. To me the main threat vector is my dev curiosity!

Lol, I know that curiosity feeling.

I honestly think this is a good skepticism to have. I generally don't hit "Accept" (or "Allow" or whatever) on any permission pop-up unless I know exactly what it's doing and what I need it for.