why attackers tends to launching a rouge network to show captive portal splash Page (for delivering a malicious link) instead of doing it using arp spoofing in the same network as the victims ?

All the methods i saw was attackers launching a rouge network to show that captive portal splash Page that opens automatically or pops up in the notifications bar...but they didnot use it to deliver the links in lan without getting users to leave the network wouldn't it be more efficient if they did so ? As it will allow access to other local devices at the same time.

​

What do you think?