Yeah, it makes sense to test for this kind of thing, but they should have planned to give the bonuses to everyone regardless of how they responded to the phishing attempt.