You have fundamentally misunderstood clickjacking. It's not about the victim navigating to an unintended site at all; a malicious site can trivially navigate a user to any arbitrary site, or cause their browser to make requests to the other site without a top-level navigation.
Rather, clickjacking is about a victim unintentionally, unknowingly, and predictably interacting with a vulnerable third-party site (the "target"), typically while the victim is logged into the target. This happens because the attacker uses an iframe (or similar sub-page embedding HTML element) to host the target page, and then uses CSS to hide the embedded target page and show the attacker's chosen UI, but cause clicks and typing to be sent to the embedded target page. If the victim is logged into the target page, then the attacker can trick the victim into taking actions of the attacker's choosing using the victim's own account on the target page. In other words, the attacker can achieve a limited degree of control over the victim's account on the target page.
An example: if StackExchange were vulnerable to clickjacking, an attacker could create an unrelated website that embeds this question page, display their own content on top of it. That content would give the user (victim) a reason to click the spot over the "Add a comment" button, and then type some sequence of characters and hit Enter. Those reasons might be any number of things; the usual examples are a game or challenge, perhaps for some prize, but it could easily be something else. The important part is that the victim, unaware of what site they're actually interacting with, thinks the action is fine, when actually it's doing something totally different.
A silly example might be a purported challenge to see how many times you can type "goats" in 20 seconds. In fact, the top-level site isn't even tracking your keystrokes... but every minute you click a "Start!" button (actually "Add a comment" on a new question), type "goats" as many times as you can while a counter ticks down, and then hit "Enter" when it tells you you're done and have to hit Enter to see the results. In reality, you're posting three spam comments a minute on this site, and will probably end up with a moderator taking action against you.
Of course, it can get much worse than silly spam comments. A slightly more convoluted set of steps carried out targeting various types of sites might cause you to delete your account, approve an attacker-chosen purchase or money transfer, send an email or post on social media with a chosen message, grant permissions to a user account on your GitHub project, use moderator access to ban an innocent user, trash your production environment configuration by e.g. deleting all your server VMs, join a video call with the attacker on a trusted site that already has camera access, or so on. Basically, anything that doesn't require you to do anything you definitely wouldn't do on an untrusted website (like type your password for a different site), the attacker can potentially trick you into doing.
