I don't think it's difficult!

• The people who want security get to keep all the security they get today.

• The people who don't think about security and leave default settings intact keep all the security they get today.

• The people who explicitly ask for less security get less security.

• Some of the homeless will get increased access to vital services.

It's a win-win—unless you believe, for some reason, that people should have security forced on them even if they explicitly ask to not have it. I fundamentally don't understand this mindset. People should have the right to do dangerous things if they are warned of the risks involved.

>The people who explicitly ask for less security get less security.

The problem with that is less security is almost always more usable than more security, which leads to the greater amount of people being in that state, which is not just a danger to the user making the choice, it is a danger to others.

Not sure why this is being downvited. You could argue that forcing security upon users is why everyone knows about password-based logon today. Same could be said about the initiative for HTTPS everywhere.

Unless the requirement is extremely onerous, very few people will go into settings to check if it can be circumvented. For homeless people, it seems that it is indeed extremely onerous, so they or those who help them will have a reason to do this, but few others.

Keeping wrong people out is only half of what is required for security. You also have to let the right people in.