It says that "no user interaction is required", so phishing is explicitly not what this vulnerability is about.

You haven't declared any privileged knowledge of this attack or MS Paint and have, on vibes, doubled down on what you assume must be going on despite other evidence.

It's a bad look.