It didn’t, the user did. I assume the fake link led to a page saying “you have to update your zoom” and downloaded malware. The kind of thing new macOS versions try to avoid with the new gatekeeper. Maybe the guy used windows?