Phishing _can_ be more or less "sophisticated" (obviously some of this is a semantic argument) attack, it depends on the details.

For example, if you select a target and collect information in order to tailor the attack, or you use inside information to prey on a flaw (such as security fatigue), that's at least more sophisticated than a typical phishing email.

Not that I disagree with your take about the PR angle.