As a lowly user, I appreciate these timely simulated phishing attempts, and do not understand the popular disgust. I know there were often articles in 2020 about users being upset that their employer would dare to issue simulated COVID relief phishing attempts and the like. But that was likely the biggest phishing threat at the time, and the security team needed to make sure that users were prepared and that the scam was in their mind in case a real one slipped through.