So this is something new:
Address poisoning involves sending small transactions from wallet addresses that closely resemble a legitimate one, tricking users into copying the wrong address when making future transactions.
Trying out to send those wallets that having that almost identical with having that 1-2 digit or just like look the same for the real user will be trying out to copy that recent transaction?
For people who don't double check properly, perpetrators could probably make do with similar looking addresses in which the first few and/or the last few characters are the same or close.
Im surprised that it work considering on how many have been victimized on this, but the main question on my mind is on how the heck will someone copy out the address from history of transactions? rather than on
copying directly with that main address written above?

It could be out of laziness. I vaguely remember reading an article about someone copying an address off a block explorer.
For instance, rather than going to a wallet/exchange to copy the address directly, they could look for it from a known addressmaybe they have this bookmarked or something which has transacted from it before.
The lesson is to always copy the address directly from source e.g. wallet/exchange. Plus double check every character to be extra sure. I've been doing this for years, and have stayed safe.