> The support is bad but this was phishing: how is it coinbase their fault?

Because they chose a support platform that makes it very easy for other people to impersonate them? We would laugh at a bank that was running their support out of /~foobank/ on a shared hosting provider, but reddit is pretty much the same thing.