"If it ain't broke, don't fix it." goes for attacks, too. Why spend weeks/months searching for 0-days and hoping they will remain viable when you can spin up a

"If it ain't broke, don't fix it." goes for attacks, too. Why spend weeks/months searching for 0-days and hoping they will remain viable when you can spin up a fake login page and a bit.ly, find the people to target and send the targeted emails in a couple of days, max?