1. They rely on e-mail while phishing attacks come from multiple sources like Facebook and LinkedIn. Sadly, using those services to simulate phishing attacks violates their ToS.
2. Simulation phishing only provides pass or fail data meaning you cannot determine your weakest links in the organization. At best you get an "average" snapshot.
3. The data isn't very accurate or precise because there are too many confounding variables involved. Time of day, subject matter, type of phishing (attachment, social engineering, etc). Normally we ran our campaigns once a month but this wasn't enough to produce stable results.
4. Clicking doesn't mean they fell victim to the attack -- lot's of people click to investigate then report the links. Ideally, I'd like to specifically know WHY the employee clicked the link and HOW MUCH was actually at stake.
4. It pisses people off. There is enough animosity against us security folks that tricking your employees really hurts that relationship. People feel taken advantage of.
5. It doesn't actually improve security in any meaningful way. I found that it didn't actually improve people's ability to spot and report phishing attempts. They either became paranoid to the point where they were no longer productive in legitimate emails, or they had no improvements over time.
6. There's a growing body of knowledge that dismisses the effectiveness of this kind of phishing training (http://www.govinfosecurity.com/interviews/training-doesnt-mi...) .
With that being said, our company has tried about a dozen of these kinds of services and the best one so far has been one called Apozy that is rather new. It's a different approach but the data and insight you get back is actually very useful.