1) The canonical use case is "steal your login credentials/crypto keys". So yes you have to care about single users, if the single user has access to sensitive info.

2) No, most people (not just engineers) are bad at risk assessment. Like thinking "my single user system shouldn't care about this".

3) I was talking about prod environments, not your random laptop.