I don't think that's true - many companies have stricter policies about this or simply block it via technical means. No outside emails with attachments or links

I don't think that's true - many companies have stricter policies about this or simply block it via technical means. No outside emails with attachments or links for example, screening phone calls and strict training. You don't see leaks from 3-letter agencies because someone phished them - while it's definitely possible to contact them. You can do a lot with training - simply frequently attempting phishing on your own employees can do a lot.