Well I think we should consider their experience is different. Many live in either the startup-land where attacks are rare and trivial, or in user-land where the attacks are just in the news, not affecting them. They don't see the daily nation-state attacks, massive botnet operations, spear-phishing campaigns, persistent multi-vector campaigns, ransomware, illicit mining operations, Amazon-laundered cybercrime. They just assume that nobody wants to hack them, so why does security need to be so difficult? And companies don't do a good job of telling people what kind of risks they are shutting down because it would scare the fuck out of people.