The one that springs to mind was the one that changes the contents of the page while it's in the background to a google log in page—very sophisticated and not something most people were prepared to spot, as people think of following a link as the moment of vulnerability.

Tons of people who are very aware and capable have been phished successfully. If you think it isn't likely, you are likely vulnerable.

"Not very likely" is just obviously not true—phishing is a very common attack, and companies like Google have adopted security keys to protect against it.