This still seems to be happening in slowroll, sadly. Would it maybe be a good idea to file a bug report for this with gnome-software upstream, or what would be the right component for this? Specifically the timing of clicking "Install" and that leading to an admin prompt being so long, rather than upfronting the admin prompt even before the download or much else is done (which IMHO would make it comparably safe from a UX/forgery standpoint).