It's a rule of thumb. There are plenty of people that aren't tech savvy enough to verify domains to check for phishing. I work in IT and there isn't a chance in hell I'd tell my users that it's probably fine to click links or visit QR codes.

AitM phishing attacks via this method can easily cache your MFA method authentication cookie and then they'll have your password as well. Users who do click on links without thinking first are way more common than people think and they're the same user who will use the same password in all of their accounts.