In a scientific context, a hypothesis is a guess, based on current knowledge, including existing laws and theories. It explicitly leaves room to be wrong, and is intended to be tested to determine correctness (to be a valid hypothesis, it must be testable). The results of testing the hypothesis (i.e. running an experiment) may support or disprove existing laws/theories.
A theorem is something that is/can be proven from axioms (accepted/known truths). These are pretty well relegated to math and similar disciplines (e.g. computer science), that aren't dealing with "reality," so much as "ideas." In the real world, a perfect right triangle can't exist, so there's no way to look at the representation of a triangle and prove anything about the lengths of its sides and their relations to each other, and certainly no way to extract truth that applies to all other right triangles. But in the conceptual world of math, it's trivial to describe a perfect right triangle, and prove from simple axioms that the length of the hypotenuse is equal to the square root of the sum of the squares of the remaining two sides (the Pythagorean Theorem).
Note that while theorems are generally accepted as truth, they are still sometimes disproved - errors in proofs are possible, and even axioms can be found to be false, shaking up any theorems that were built from them.
If someone is consistently falling for phishing emails (real, or from the IT department), shouldn't that person eventually be fired? Isn't that a punishment?
If there is neither a punishment nor a reward, what is the incentive to learn? Some people may not need one. Many others do.
I agree that a single failure resulting in the loss of significant income might be harsh, but I think there needs to be a way to convince people to take the issue seriously, and a punishment of some kind is therefore always warranted (e.g. eventual firing).
You can balance out the issue by creating a reward system as well, e.g. if you report all of the test emails sent to you in a year (i.e. not just ignore them), your bonus is increased by X% or something. Similarly, if you report an actual phishing email, your bonus is increased by some percent, even if you initially fell for it. I think it is possible to foster a consciousness and honest culture, with a system that includes punishments.