Phishing attempts are largely avoidable

Couldn't disagree more. Generic phishing attempts are. Specific others aren't.

I used to get regularly tested at previous companies and failed a number of them where they were highly contextual e.g. emails were spoofed from real, internal emails asking you to check if a website was available e.g. JIRA, Confluence which have roughly standard website subdomains.