> improved education and targeted campaigns against common security pitfalls

Which doesn't work. At all. A familiarity with the last 40 years of computing makes that clear.

The only things that have worked: ios/android walled gardens so users can't install spyware. yubikeys which can't be phished. etc.