I think "zero-click" usually refers to the interaction with the malicious software or content itself, which in this case you don't have to interact with. I'd say the need to start an interaction with Copilot here could be compared to the need to log into your computer for a zero-click malware to become effective. Alternatively, not starting the Copilot interaction is similar to not opening your browser and thus being invulnerable to a zero-click vulnerability on a website. So calling this a zero-click in Copilot is appropriate, I think.