That's a little bit Victim Blamey.

Security unfortunately relies on users doing things at least somewhat right.