I bet non-compliance with best practices accounts for 10x the amount of "less secure" than anything else. (Like in birth control)