Sadly there will always be at least one employee that just does not learn, until it is too late, that you do not click on links in emails that come from questionable addresses or questionable situations.
Some years ago our company got hit with a ransom ware situation. I remember getting an email with a weird link in it. The address looked like it could have come from a reputable source but it was slightly off with a spelling error.
I deleted it from my email. Told co workers not to click on it if they get it. But of course there was that one employee. An older lady that was already shaky with some computer related situations but also one of those people who think they know more than they do. She clicks on the link. It downloads the program and they wind up paying money not to lose info no their server.
I backed up all my work on a weekly basis for some things but on a monthly basis for all things due to monthly reports. So I would have been ok but others were not as vigilant.
Many users are savvy enough to avoid those emails, use ad blockers in case they are on various web sites. But like I said earlier, there will always be that one employee, at least, who thinks they know more than they do that will click on a link they should not and that is all it takes