I'm not sure what you view as misguided, but it's a somewhat effective and accessible tool in the box for CISO to gauge and graph employee behavior when confronted with suspicious communication. Also I have no idea how "1 internal domain" has anything to do with phishing on some dude's phone.