Whether or not a promise of a gift is a legally binding contract, there's a vast difference between a promise of a gift and a promise of a bribe.
If a company had a pen tester send what appears to be a perfectly legitimate message to employees offering them a company bonus for responding (during a worldwide pandemic where everyone is short on money), and then says it was a pen test and they've failed, that company is awful and heartless. There might not be a legal case against them, but the company is still deserving of public scorn and outrage.
If I put myself on the other side, I'd stop producing gross sexist ads, stop supporting overreaching internet legislation, and stop treating my employees like garbage.
A phishing email can come from the inside. But seeing whether employees will respond to a valid internal email is not a test of employee security. And in this case, it was as heartless as it was useless.