Is there any other field of computer security where this argument is acceptable? Usable security matters. Ecosystems matter. You cannot put a boundary somewhere in the middle of what the end user sees and call your security job done.

When people majorly botch x509 cert validation because the spec is so monstrously complex that's still a problem with x509.