Phishing tests can spark resentment when taken too far, and may not even be particularly effective, according to a recent study.