Sure, but here's the critical thing: the security team isn't a threat actor, they're coworkers. Their job isn't to steal data but to protect it and get coworkers to better protect it.
Doing stuff like this doesn't advance that goal, and actually hinders it. Now a bunch of people think the security team is full of assholes and the lesson taught is "the security team will trick you, get you in trouble and also good things never happen here".

They now know that they could face a breach from an enticing phishing email, which isn't actionable. What do you do with that information that you shouldn't have already been doing?
The cost is that now when someone does something like actually fall for a phishing attempt they have less reason to trust that security is on their side, and more reason to brush it off and try to obscure it to avoid getting in trouble with security.

A better way to train users is to use rewards. Tell them you're running a phishing campaign and properly reporting it gets a chance at a gift card or prize. Then tell them you're going to keep doing it, and that legitimate phishing reports also get a chance.
It costs you $100 a month, no one is mad at security and it's easier for users to see it's an excercise rather than an attack.