People trust (wisely or not) in the big companies Google etc. to do the right thing. That's because they have other priorities in their life, and limited head space. They need to be convinced this is an issue. I am not even convinced it is the most pressing issue for me, and I am a techie. I do minimal stuff (password managers, 2FA, try to avoid sending stuff by email) but I'm not going to start buying keys off Kickstarter.

The only exception is a small amount of Crypto which I have been a bit more paranoid about (see money is at stake so I care a bit more!), for example I have the myetherwallet source and run it locally instead of using the site as that is a very attractive honeypot. I could get f'd using the source but it is less likely. I check for recent dodgy looking commits and check the news.

Not saying I am right but just sharing my point of view.