These gotcha games suck, but they're necessary. And it's not just email, it's phone calls, it's social engineering, it's fake paper invoices, it's fake AI voices, it's deep fake live videos, etc.
And yes, automate your defenses, automate as much as possible, but that's not enough. Every day, there is a new scam out there, or a new vector of attack, that automation doesn't take into account yet. It's a never-ending list of problems that requires never-ending education.
And yes, let's not make fun of people, but let's assume that people are going to make mistakes (even after having been trained), so let's continue to do penetration testing (in addition to all the other precautions we take and all the defensive automation we create).