This is exactly the case. It's not continuous training. It's often one time training at hire then never mentioned again until something happens, like this.

https://youtube.com/shorts/VAWwtjtRM98?si=bBJlan5KAI7ihwlO

Phishing and Social Engineering attacks can target anyone in a company. Everyone needs consistent training to keep it in their mind and not become complacent.