It's the url, i'm sure it had a get parameter to identify him.

Sure. Companies run phishing trials all the time; it is a favorite pastime of security consultants. They want to see how many of their employees will click on suspicious links. It's extra-difficult to deal with SMS when it comes in from the airwaves, and not a company-controlled system that can be firewalled and IPS'd.

It seems misplaced to blame the company for surveillance when they're trying to keep everyone safe, including the devices in your home. It seems far more preferable to have a sting operation and catch mistakes, than to for-reals access malware and have it install on those same devices. That's exactly what they're trying to prevent and mitigate.

It would be the same whether you're at home on a personal device, or you're at your desk in the office with boss over shoulder. You would have a right to object to oppressive or intrusive company surveillance, but this doesn't even come close.

Of course, we have few details here, and I have leapt to a very particular conclusion about that situation; who knows what really happened. But in the interest of general knowledge, employees should be aware that phishing tests will be run, and you can expect to have a little chat if you fail the test (or actually get phished.)

Trying to keep everybody safe using misguided strategies that do not work, instead of doing something that works (like using 1 internal domain and nothing else, for example).

I'm not sure what you view as misguided, but it's a somewhat effective and accessible tool in the box for CISO to gauge and graph employee behavior when confronted with suspicious communication. Also I have no idea how "1 internal domain" has anything to do with phishing on some dude's phone.