I don't think it's a flaw, as the UI evolves with the specs this hypothetical might be eliminated. But since as you mention the user would first have to grant permission, and the option to revoke is available "revoke and report" is the best course of action, I doubt Google SafeSearch would even let you land on said hypothetical malicious site.