I didn't get the point of the article. Is it to point out that many can't tell whether they're getting phished? Or is it that Amazon's APIs aren't secure? Not

I didn't get the point of the article. Is it to point out that many can't tell whether they're getting phished? Or is it that Amazon's APIs aren't secure? Not really sure what the point of this is. Regardless, how would that white-hack hacker get so much access? Can you do this with Amazon's APIs? I don't really use Amazon APIs to know.