For the average user, you're probably right. In more secure environments, relying on the rational behavior of outside parties for your security isn't tenable.