Interesting. On one hand, it’s insensitive. On the other, actual phishers aren’t going to be respecting your feelings either. Anybody who failed this is indeed a cyber risk.

(Obviously the employer shouldn’t have been making their lives hell in the first place, but that’s an entirely different issue)