Phishing _can_ be more or less "sophisticated" (obviously some of this is a semantic argument) attack, it depends on the details. For example, if you select a

Phishing _can_ be more or less "sophisticated" (obviously some of this is a semantic argument) attack, it depends on the details. For example, if you select a target and collect information in order to tailor the attack, or you use inside information to prey on a flaw (such as security fatigue), that's at least more sophisticated than a typical phishing email. Not that I disagree with your take about the PR angle.