Asking for a friend! How can this happen on an Apple computer?

It is an ad where the website that was visited was paid to show that to them and the purpose is to try and scare them to download their product. You will see those on any computer or any device when visiting less than legitimate websites.

No different than receiving an email on any device claiming you are a beneficiary of a large inheritance from a Prince overseas and all you have to do is give them your banking account information.

VivienneUK wrote:

What should she have done, instead of just trying to close Safari?

Closing the offending Safari window, quitting Safari, or force-quitting Safari was the right thing to do.

The message saying "Don't leave this page until you have undertaken all of the essential steps …" is a standard part of many worthless advertisements and outright scams. The purpose of the message is to trick readers into not taking appropriate action!

The follow-on is restarting Safari with the SHIFT key held down (so that it will not try to immediately reload the Web site that presented the message). Then, perhaps, clearing history and removing saved bookmarks to the Web site that presented the message.

Those pathetic scams are commonplace. They can appear on anything that can run a web browser. That includes Macs, Windows PCs, Linux computers, iPhones, Android phones, smart watches, probably even refrigerators.

Read Phony "tech support" / "ransomware" popups and web pages - Apple Community

Should she go ahead and install McAfee?

NO

This is simply the inevitable side effect of security being reasonable, and of vendors finding effective advertising strategies.

Breaking security: hard

Fooling people: easier.

Actually hacking a device: hard

Convincing people to install who-knows-what app, or convincing people that they were breached or some iPhone was purchased at APPLE STORE EAST OVERSHOE NEW HAMPSHIRE APPLE PAY CASH FRAUD and they need to enter their Apple Account credentials to cancel the fraud, or convincing the Google search engine that the scammers’ rubbish “support” sites should be first in search results, or faking calling phone numbers: easier.

And my favorite from this particular scam: scammers convincing people that a remote website could “scan” their equipment for malware — a scan being one of the most deeply intrusive operations possible — because a website that could remotely scan your gear wouldn't bother with the lies, and would just steal everything directly.

Or more simply, the advertisers lied about the malware scan, the lie worked, and now you want to buy some of what can be unnecessary and often-problematic anti-malware app, in addition to the built-in anti-malware.

Close the offending website, then restart Safari while holding the Shift Key.

Well, it can happen on an Apple computer in the same way it could happen on ANY computer. Your “friend” obviously visited a site involved in bogus advertising tactics. If your friend actually clicked the SCAN link, they obviously fell for the scam.