Spoofing is about identity. Phishing is about deception.
An attacker can spoof a sender identity to make a phishing message more convincing, but phishing does not require spoofing. A compromised real mailbox, a newly registered lookalike domain, or even a legitimate consumer mail account can be used for phishing.
Likewise, spoofing does not automatically mean a message contains a phishing payload.
Why the distinction matters
SPF, DKIM and DMARC can reduce unauthorized use of a protected domain, but they cannot stop an attacker from registering a similar domain or taking over a real account.
That is why email defense also needs identity security, filtering, user reporting, endpoint controls and incident response.