I've always thought it's more a matter of ignorance. Most infosec risks are fairly abstract and difficult to grasp for non-technical folks. Many don't understand why what they are doing is bad.

I really think that the infosec needs to do a much better job educating the public.