If your site is only hosted on one server and it catches fire, you can swiftly reinstall on a new server and change the IP your domain is pointing to, too... Still a single point of failure.
I run a small, extremely niche fan site with under 500 users, and I received a very similar email the other day - someone complaining about the "cookie popup" (which my site doesn't have), and then sending me a "screenshot" in a sites.google.com link when I told them I don't know what they're talking about.
Only difference is that it downloaded a .zip file containing a shortcut (.lnk) file which contained commands to download and execute the malicious code.