Although you're technically right, my point is more along the lines of people just being in the default state of skepticism. Be as secure as you, personally, can possibly be and just assume that everyone else isn't following standard security protocols, that their SSLs are invalid, and that they're monitoring what you're typing.

It's similar to the old adage about driving: "Drive like everyone else is an idiot out to kill you. Don't be right, be predictable."