I think you're both right - they way I read their comment was more like "if you expect a phishing attack from certain sources, this implies you're not on the defensive against attacks which aren't from those sources".