I disagree. The point in either case is to get a cookie of the attacker's choosing accepted as the session identifier for the privileged domain.

But even if we consider them separate techniques, the mitigation strategy is identical anyway.

Yes mitigation is identical