Security is pointless if platform allows 90% users to be social engineered into running code disabling that security