It's much much harder to block emails that aren't actually phishing but have components that would flag them anyway.