They seem like an unreliable narrator, at least by how they're describing smartphones. I don't believe the URL claim at all - on my phone I just see the domain and 5 characters after before it cuts off. A password reset type link would be a huge scramble of characters. They don't even mention leaving zoom.com. OTP notification popping down briefly makes much more sense. And visually it would be the same place as the URL bar.