If a company had a pen tester offer bribes to people, and those employees accept bribes, the pen test was indeed failed and those employees should be rightfully reprimanded. That's good security.
If a company had a pen tester send what appears to be a perfectly legitimate message to employees offering them a company bonus for responding (during a worldwide pandemic where everyone is short on money), and then says it was a pen test and they've failed, that company is awful and heartless. There might not be a legal case against them, but the company is still deserving of public scorn and outrage.
Put yourself on the other side. If their employees are failing this test when they send such messages themselves, the company cannot feel comfortable that they are secure if a malicious actor sends such messages to their staff. It's a case of bad vs. worse. There are no winners here.
It's a message from a valid internal email address. If a company's own email servers can't tell the difference between valid internal mail and external phishing, that's the company's problem, not the employees. If the company's email is hacked so that a hacker can send valid emails from a legitimate internal email address, that's the company's problem, not the employees. Nothing of value was learned by this test, besides the disdain GoDaddy has for their own employees.
If I put myself on the other side, I'd stop producing gross sexist ads, stop supporting overreaching internet legislation, and stop treating my employees like garbage.
If a hacker hacked the CEO's email address, and then used that address to email their secretary asking for information, and the secretary responded.... that is not a security failure on the secretary's part. That's the CEO's security issue, and the company's security issue. Therefore, it's a useless pen test, unless the purpose is to tell employees no emails from anyone can be trusted.
A phishing email can come from the inside. But seeing whether employees will respond to a valid internal email is not a test of employee security. And in this case, it was as heartless as it was useless.
If a company had a pen tester send what appears to be a perfectly legitimate message to employees offering them a company bonus for responding (during a worldwide pandemic where everyone is short on money), and then says it was a pen test and they've failed, that company is awful and heartless. There might not be a legal case against them, but the company is still deserving of public scorn and outrage.