I don't see goalposts being moved. It seems like your base assumptions are just different from most people. Most discussions about security assume that users are taking care of their passwords and private keys, and talk about how secure a system is _given_ that assumption. If start assuming that stealing computers and getting people drunk to steal passwords is reasonable, then there would be no point to any of the security measures on the web