Maybe this got lost halfway down this comment thread, but the whole point of this being considered phishing-like is that Oracle was emailing individual developers, asking questions about their use. The developers didn't realize so that Oracle can build a case against their employer and accidentally gave away details that Oracle would then use to pressure the employer to get licenses or would outright sue.

Developers likely thought they were speaking to Support, or responding to some kind of survey/questionnaire about their use cases and how they use VirtualBox, when in reality were being misled as to the actual purpose of the conversation.

Just because they were speaking to someone from Oracle as opposed to a third party scammer does not mean that the person they were speaking with didn't misrepresent/fake who they were.