A regular user would also not not care about "web sessions", "permissions", "silent updates", and all the other techno-mumbo-jumbo they will file away in their folder of Do Not Care.

Essentially, there's an issue of hypocrisy in the threat model and type of user proposed.