Will there be trap clauses in the NDA and contract to see if they carefully read every line ? Will they be left with no onboarding on day one to see how far they can go by themselves ? etc.

You're starting the relationship on the base of distrust, and they don't know you, they have no idea how far you're willing to go, and assuming the worst would be the safest option.

> it's very similar to anti-phishing training/tests

With the crucial difference that the candidate is someone external who never consented to or was informed of this activity.