An undelivered gift is not a contract. This is covered in first-year contract law.
Yes, it's true that an undelivered gift is not a contract...but you seem to have forgotten (or possibly never learned) about promissory estoppel. If the giftee was told of the gift and reasonably acted upon the expectation of the gift, then the gifter could very well be obligated to actually deliver the gift. This is covered in first-year contract law. There are indeed a great number of cases on this point in which the gifter was required to provide the gift.
Also, generally employee bonuses are considered compensation for labor, not gifts. Labor laws trump contract laws. If a company tells an employee that they are getting extra compensation through an official means of communication (like an internal email), they may very well be bound to that, even if it turns out the email was just a phishing test sent by the IT department. You do not fuck with the Labor Board.
Whether or not a promise of a gift is a legally binding contract, there's a vast difference between a promise of a gift and a promise of a bribe.
If a company had a pen tester send what appears to be a perfectly legitimate message to employees offering them a company bonus for responding (during a worldwide pandemic where everyone is short on money), and then says it was a pen test and they've failed, that company is awful and heartless. There might not be a legal case against them, but the company is still deserving of public scorn and outrage.
If I put myself on the other side, I'd stop producing gross sexist ads, stop supporting overreaching internet legislation, and stop treating my employees like garbage.
A phishing email can come from the inside. But seeing whether employees will respond to a valid internal email is not a test of employee security. And in this case, it was as heartless as it was useless.