My feeling is that it's like computer security, you can bleat all you like about how the millions of developers have to magically know this stuff, or you can build it in by default.

One method works, one doesn't.

But keep on telling people to read a book, for all the good it will do.