I don’t know if those examples are covered under the APP code or not - but reading around suggests the protection applies if the users follow steps that are expected of them under the code - which I imagine covers things like Sharing pins etc.
And also expects the bank to support - ie the payee confirmation bit and beyond.
So cases like “I got a call from British Gas telling them I was overdue and they gave me bank details to send money to” - the kinds of scenarios intended to be covered.
Cases like I gave someone my login / PIN, not so sure. In practice some banks are possibly going beyond the scope of the code to prevent bad PR.