'If you have prepared staff and software you are not going to be affected'
All of it is true, no discussion here.
But that's not how real world works. Complex systems, large staff of various skills, temporary access for temporary fix that becomes an established feature because there is something else more important, people leaving and so on.
That's how a <insert boring item> company ends up with their DB not backed up or backed up locally so that's encrypted in the attack too.
And you need info on orders, deliveries, and money etc RIGHT NOW!
What do you do?
You can't get rid of the Marthas because the Marthas have been here 30 years and hangs out with everyone from the company on weekends, and probably knows more about the business than anyone even if you wanted to get rid of her.
The former are following a script with most everything they do, while the latter have enough understanding to think in categories of behavior and to predict or explain things, at least a little, which doesn't make them immune to phishing, but does make them significantly harder targets. The latter sort are less common than one might hope, even among those younger than Martha, though, which becomes clear if you talk to people who work in non-technical offices—bearing in mind that all but the oldest workers are now mostly Gen X and Millennials, with only a few raised-on-phones Gen Z so far.
Overall, I'd say all signs point to every general-purpose desktop operating system being a usability and security disaster for at least half the population of non-oldsters.
It's not like Ransomware is some god-given thing that just happens.
There's a case in Germany right now where the critical Confluence bug was simply not patched for two weeks after the notice that there's a critical bug/exploit. Now the systems are down and everybody's wondering how that could probably have happened...
"Won't happen here" is easier than taking care.