Exactly, how many people didn't really care about unencrypted requests over public WiFi networks until everyone and their grandson could install Firesheep? Tools to make that attack had been available forever, but only after Firesheep did many people finally accept that basically any authenticated request should be done over a secure channel.

For a huge majority of folks, some unfortunately in the position of making decisions and policy surrounding security, the attack just isn't real until there's a nicely usable and widely available tool.