is there any evidence that this sort of testing actually works Yes. I don't have the reports and graphs and would not be permitted to share them even if I did

is there any evidence that this sort of testing actually works Yes. I don't have the reports and graphs and would not be permitted to share them even if I did, but I worked for a company that handles as-sensitive-as-it-gets data. We did phishing tests multiple times per year. A percentage of people would click on the links and a sub-set of them would enter corporate credentials. Those employees were required to attend security training. There were incentives for leadership to get the numbers down and down they went year over year. The greatest focus on re-training was applied to those with access to customer data, production and development environments. I do not have an answer for OP's question however. I think lawyers and legal agreements would be required for people outside of a company that have not signed vaguely worded terms of employment documents. I personally would not perform such testing at the risk of landing in the bog of eternal stench. a legal quagmire