an unlikely pattern for a phishing scheme.
Time delays increase the difficulty of chain analysis if you're working to obfuscate the tainted inputs from the desired clean outputs - maybe not all phishing attackers, but smart ones would probably treat each case that had a large amount of BTC independently. Besides, it's best to wait for periods of highly-active blockchain volume to use as a smokescreen: current mempool stats show much lower tx counts and fees than some spikes several months ago.