I don't know anybody who specializes professionally in phishing that believes this. What I hear from those kinds of people, and many others, is the opposite: that especially when you're trying to secure an organization, the one attack you feel helpless to prevent is targeted phishing. Technologists in particular are apparently easy to victimize; they underestimate how malleable the medium is, and how well sophisticated attackers understand the cues we all rely on to evaluate the legitimacy of messages and gate the shortcuts most of us take.

My suspicion is that anyone who downplays phishing attacks is betraying a lack of understanding of how scarily effective targeted phishing attacks are.