Phishing is basically that you have a web address that appears to be legit, such as: www.reddit.com but you end up somewhere else. Software that protect against this is often the only way to detect it if a competent scammer with mail server root access. If a state actor would do it, they would have even greater range of tools for spoofing or switching IP numbers within their own territory.

Her phone (or any client) is not the real target but the mail servers. If you control the servers, then you control the mail clients.

All you would need is a mail server script that automatically adds a fake virus infected pdf file attachment with the same name as a real word document sent by Hillary or anyone at @clintonmail.com When it doesn't open properly, the normal user thinks nothing more about it and instead opens the perfectly fine word document.

(We've seen nothing about State disabling such protections. If they did that would be a massive scandal by itself. Something Team Clinton would gladly hop on to provide themselves cover.)

But this is EXACTLY what they did. If you read through the emails you see that they start with disabling the spam filter but it wasn't enough, they had to disable the phishing filter to receive Clinton's emails. (It start from page 17).