What's particularly annoying is that HR and finance functions are often among the most likely to involve outsourcing, even as they're also the most sensitive. If I wanted to spear-phish someone, it would probably be through something that looks related to a care provider or financial institution that the company uses, not to the company itself.