Or more to the point, what would stop someone from sending malicious documents to the employees' work emails? Figure out a company uses <some-saas> register a

Or more to the point, what would stop someone from sending malicious documents to the employees' work emails? Figure out a company uses <some-saas> register a phishing domain (e.g. gith.ub) send them an email with important info about their account, and a PDF attachment with more details. If it's that easy to compromise a system all you have to do is get a few employees to open the PDF right?