You can only be phished by those emails/sms that are embedded with links to a phishing site if you ever filled the information which are most of the time (if not always) vital to you. Such as username, email, password, PIN, account numbers, etc. So double check the link that you are visiting before you input any credentials.
I will take a guess, I think he is trying to say malware that is auto-installed when we click the link. We can't deny the possibility that aside from redirecting to phishing sites, some advanced malware is also embedded on the link that auto-installs when clicked. Kaspersky or other anti-virus and Malwarebytes often detect this kind of malicious website which is why having an anti-virus/malware installed on our pc is needed. to block this kind of malicious attempt. But of course, phishing sites unless reported can't be detected by this anti-malware software, so double checking as you stated is highly advised.