Aye. I care slightly less about this from my perceived threat model (if you go into the business then you know what's coming to you, whereas your end users are

Aye. I care slightly less about this from my perceived threat model (if you go into the business then you know what's coming to you, whereas your end users are a lot less likely to understand the risks) but it's still worth thinking about.