N: So will I have to change all my passwords?

ME: Yes, you should.

N: That's a lot of work.

ME: Yes, but if you don't someone is likely to break into at least some of your accounts. At least make sure you've changed the password to your mail account, and set up two factor auth [very simplified explanation of what two factor auth involved], and check that all accounts you care about use that mail account for password recovery.

N: I'm not sure if I can be bothered.

This is a relatively technically experienced user.

It fits with other experience I've had, that security is perceived as a hassle until it's too late and then users do the bare minimum, even in the face of ongoing threats.

Corporate users might help drive adoption, but only if the cost and hassle is limited enough, and the damage of not going there is high enough.