It's more work if you're targeting a single user with the intent to steal their PoF password.

But it's a lot less work if you already have access to the email account or server, or any server that the email message passes through - now you suddenly have a user's credentials, for free.