(From the linked study, not the article)

Annual Security Training: At UCSD Health, each employee must complete a standalone security awareness training once per year (with the material designed by KnowBe4).

When employees first join, the HR system automatically assigns an employee this annual security training to complete within a few weeks. Once a user has completed their training, the system automatically reassigns this training to the user after one year (365 days) has elapsed

I haven’t dug very deep into the study to see what the training actually involves but this sounds like something employees would just bullshit their way through as fast as they can. I don’t think this proves that training in general is ineffective but that it needs to be made more engaging and interactive

Security/privacy. With a dumb phone you’re restricted to standard phone calls, SMS messages, and (sometimes) email. All of which are ancient standards that weren’t built with security in mind. Your network provider likely keeps logs on your calls and texts