> People will always do what’s easy even if less secure. The bigger lesson is why we still haven’t learned to sandbox sandbox sandbox.

Because nobody has figured out how to make sandboxing easy, apparently.

N.B. at this level, "easy" has to include "provided by default with the operating system".