The difference is the malicious actor and the email sender don't have to be the same person.
A malicious user can craft an email "this is [abc.zip](http://very-bad-website)". Ok nothing new here.
But a non-malicious, who's emailing their mom: "I've attached abc.zip" (and put a abc.zip as attachment).
Here the problem here is a malicious other user has registered abc.zip to download a virus, and the mom's email client highlight abc.zip, and she clicks on it instead of the abc.zip attachment.
