> let's not downplay the blast radius of basically every attack that involves telling the user to do things.

That radius would be negligible should the things that must remain secret remain offline.

But no, that's a luddite thing to even think about in an all-connected ever-online world where even wiping one's ass is done via of a swarm of dedicated apps.

On the other hand, there has always been a way to extract secrets from a granny via a mere voice call, so no amount of dumbing it down would really help.