If they use/provide company vehicles, would they test potential employees to see if they know how to change brake pads or replace a timing belt?
Relying on some test to see if people know not to open an email from "Hot Sex Machine" with a "cool app you must see now" is lazy IT administration. I know that small businesses often cannot afford an IT person, but to rely on some test is bad management. Are they going to retest people every year to make sure they're up on the latest scams or social engineering techniques? Will they pay people to take the time to educate themselves on this stuff?
I'm sorry, but this would be like requiring employees to provide their own safety equipment, develop their own lock out/tag out procedures, and maintain their own confined space entry plans. It'd be like saying, "We don't have to implement safety guards because we test whether people know not to stick their fingers in moving machinery." Such things are the responsibility of management. If management provides a tool (a computer, a machine, a car) for an employee to use, it is the responsibility of management to maintain it and provide the proper training on it. Otherwise, it's just pushing the cost off to the employee.
I understand that as a small business, this may be a challenge for them. But if they rely on some test, they're going to end up with a hodge-podge of protection with some minimal baseline. This is not good management.