It's a common pattern with a lot of "awareness" and media problems. There's a big problem with something, people start noticing it and "raising awareness" of it

It's a common pattern with a lot of "awareness" and media problems. There's a big problem with something, people start noticing it and "raising awareness" of it and publishing articles, books, etc on it. Now several things happen at the same time - people who are responsible for the systems that have the problem start addressing it and it gradually starts getting better in response to the publicity and complaints, but at the same time, the community of people finding and drawing attention to the class of problems gets bigger and develops more infrastructure and institutional culture. Groups get created and funded, people start full-time careers with those groups, regular magazines and websites get published and develop their own staffs, etc. Usually, the underlying issue is complex enough that it takes years or decades to make the problem like 95% better. But the community around the issue has become entrenched, and won't go away just because the problem is basically solved. There's plenty of excuses at hand to justify the continued existence of the group - the problem is never 100% gone, so there's always something new to address, and they can always say that we have to be on guard for the problem coming back. But the effect is the same - the noise gets louder as the signal gets weaker. If you're paying attention, you can see this pattern play out for all sorts of things. In this case, we have both made the computers and browsers a lot more secure, and a lot of consumer-level computing activity has, for a bunch of reasons of which security is certainly one, moved to drastically more locked-down devices. Good luck building a botnet of iPads and Android phones. Many of the hacks that get the most publicity are super-complex one-offs that are in theory highly dangerous, but in practice are so valuable that they would only ever be used by state-level actors against handpicked national security targets, because you have to spend millions to find them, and they will become worthless about a week after the appropriate companies become aware of them.