I think it is rather the problem of poorly designed software. It is impossible to make millions of users to set up some secure configuration, install firewalls

I think it is rather the problem of poorly designed software. It is impossible to make millions of users to set up some secure configuration, install firewalls etc. The software should have secure default settings, if a user is not a computer engineer he should not be able to execute files from email attachments.