Where does it say that you can't be phished with a bmp file?
Maybe you should self-reflect on why you are offended by my comment. You might learn something about yourself.
It says that "no user interaction is required", so phishing is explicitly not what this vulnerability is about.
You haven't declared any privileged knowledge of this attack or MS Paint and have, on vibes, doubled down on what you assume must be going on despite other evidence.
It's a bad look.
loading story #50397313