If your design allows insecure setups without users understanding the risks in full, I think that's on the providers and not the user. If the user understands the risks fully, then it's on the user.

I think we are way far away from users fully understanding the risks, and we're still mostly dealing with people not realizing they're vulnerable. So I put this primarily on the provider.