Agreed. This is something that made me very annoyed when they did it to us. I know exactly what I'm doing, I know that you can't infect a computer from opening a link unless the attacker possesses a new browser 0-day, and expecting your average employee to worry about new browser 0-days is ridiculous.
If it were an obvious phishing URL, like a variation on the company domain, then fine (maybe). But it wasn't.
If it were an obvious phishing URL, like a variation on the company domain, then fine (maybe). But it wasn't.