There are security firms that run periodic social engineering attacks against their clients, including phishing attacks. This is a service performed to both better educate employees at the client companies and keep them aware of new attacks, and to flag those who fail often. Someone has to come up with the phishing attacks, granted probably not an entire career right there.

I mean you can, but it wouldn't be ethical or in some cases legal. Spying does still exist. Phishing is just a really low level attempt at gaining information from someone, and it works. I can't imagine it's not used by people who have good, albeit questionable, careers.

Yes you can :D even more nowadays and you will have plenty more money than having a full life debt and working for a corporation.