>Is that "phishing"? Those actions should be secure to perform in a browser. The security model of browsers/computers is such that I don't need to establish authenticity/trust in order to click the link or even download something.
You don't understand how hacking and planting of malware works. Hackers abuse zero day vulnerabilities in order to drive by download malware onto user's PC. They use exploit kits in order to manage and plant malware by abusing browser's or computer's zero day exploits. So when you visit a malicious website with vulnerable browser malware silently gets downloaded(drive by download) onto your PC.
On the other hand one of the most common email attachments is Microsoft Word document and again just like with browsers Microsoft Office and Microsoft Word have many zero day exploits or simply existing vulnerabilities(exploits) which user didn't patch so attacker abuses these kinds of exploits in order to drop malware when user opens Microsoft Word document and interacts with it.
Summa summarum: Hackers use zeroday or existing exploits to plant malware or they make lookalike websites or documents to trick you into giving your login credentials and/or payment information(credit card, bank account information etc.)
>The security model of browsers/computers is such that I don't need to establish authenticity/trust in order to click the link or even download something.
You do; websites use SSL certificates and computer files get digitally signed as well.