You're suggesting to put a ("snort or similar") IPS console in front of the end-user who still clicks on the "click this to view my photos" sexy-pics.exe?

In my opinion, the end-user is not the one causing the problem. The manufacturer is causing the problem and -- just like we do things at $work -- he who causes the problems (should be the one who) suffers by being the one to also fix it.