I don't. The phrasing was "both exploits do require tricking a user via a phishing attack into going to a malicious website". This suggests that the blogger b

I don't. The phrasing was "both exploits do require tricking a user via a phishing attack into going to a malicious website". This suggests that the blogger believes that the only attack vector involves tricking the user to go to a malicious website; I can reasonably see calling such attacks phishing attacks. The problem (which is, in my opinion, more serious) is that, as you identify, the blogger seems to horribly misunderstand the potential attack vectors.