I think you are misunderstanding what is possible with the history API.

Pages can’t read your navigation history.
Pages can’t manipulate history prior to their loading.

The original history API is a careless mistake. It can:

• Tell the browser to navigate forward n entries.
• Tell the browser to navigate backward n entries.
• See the length of the history stack.

Seeing the length is a privacy problem. Allowing arbitrary forward navigation is a usability problem that’s ripe for abuse. Allowing back navigation to be more than a single page is a usability problem.

The newer pushState and replaceState APIs are fine. As their names imply, they push a new URL or replace the current URL in the navigation stack. The URLs are also subject to same-origin constraints, so you can’t just replace the current page with an entirely different domain.

Using a replaceState followed by pushState to insert a dummy marker that runs history.go(1) when the popState event is fired allows pages to prevent users from navigating away from the website. That’s shitty and abusive, yes.

Do you know what else can do that, though?

if (window.location.hash != "no_redirect")
    setTimeout(() => { window.location.hash = "no_redirect"; }, 1000)

Or

<?php
if ($_GET["no_redirect"] != "1")
    echo '<meta http-equiv="refresh" content="1; url=?no_redirect=1 />';
?>

Back button hijacking is an infuriating problem, but it’s not a new one exclusive to SPAs. This fuckery has existed for a long time.