Yeah they even state that on their website with a lot of warnings. Because you simply can't make it secure enough, phishing is easy to do since all you need to do is to download the HTML page with CSS and JAVASCRIPT from other website (as it is available, thats how our browser see websites, code is somewhat open) so you just need to copy that and you have yourself a website, create where you want it to send you the form and bam its over. One of the most dangerous things, which people don't really realize, is that they are used to act and think that it is safe if they see a green lock, left from the URL website, which indicates that website uses HTTPS so that not 3rd party can see what you are exchanging between the server. But it doesn't tell you that it is the real site and 100% secure as many think, when they see it they feel safe and that they are on the right webpage whcih turns out easily to be false.