I agree that actually securing a wallet, independently, as a non-technical user, is difficult. It is further exacerbated by, as you mentioned, the general hype around crypto related apps that promise to do this in a trivial way, which can often be traps.
I also, however, think your final question presents a false dichotomy, as the two (Exchanges and users) have different threat models.
Exchanges present a larger, highly lucrative target, meaning they are ammenable to expensive, targeted attacks as they can still be possible.
The security model for an individual user can be to secure their coins in a way that is relatively secure (Maybe not as absolutely, as they are not experts), but more importantly to secure their coins in a way which a scalable attack against many users is not tenable.
In this way, just because exchanges get hacked doesn’t necessarily imply that normal users don’t have a chance, as they have different threat models with their own nuances.
Edit: Cleaned up some wording
"Only techies can use it!"
Pick one.
Someone's ability to use a smartphone doesn't mean they're capable of patching the thing to keep it secure.
I've had half a dozen non-technical friends ask me about getting into Bitcoin in the last month or so. Media attention, get-rich-quick, scams, etc. are all attracting hordes of people, to the point where the Coinbase app was #1 on the App Store for a while.
Even the people running exchanges are getting hacked. What chance does a normal user have?