The point about 'educating users' being dumb is itself incredibly stupid, because the largest element of hacking is social engineering: the letter from a nigerian prince, the zip file from an attractive person with 'my hot photos enclosed', to today's calls from government impersonators (tax agency, immigration), and emergency requests from close known contacts that 'urgently need money wired to them'.
Education has gone a long way to improving user response and caution against default trust of unverified contact, which is essentially what the first two points complain about from a technical aspect (default allow). Those complaints are at odds with one-another.