A UC San Diego study found phishing training programs are basically useless, with employees just as likely to click scam emails whether or not they took training.