It's always infuriating getting email from Amazon or my bank "here's signs of potential phishing emails/texts" that doesn't include an exhaustive list of every email address and phone number that that organization will try to contact me from. That should be table stakes when it comes to phishing avoidance, and it's something that can only be done by the business, not the customer.

Yes, like you say, there's always the chance that someone hijacked an official domain - that's where other things like a formal communication protocol ("we will never ask for your password", "never share 2FA codes", "2FA codes are separate from challenge-response codes used for tech support") and rules of thumb like "don't click on shortened links" come in. Defense in depth is a must, but the list of official addresses should be the starting point and it isn't.