I think it's more that you should be aware of the strong limitations they have and weigh that against cost imposed, and what better solutions are available. To

I think it's more that you should be aware of the strong limitations they have and weigh that against cost imposed, and what better solutions are available. To take the IDS part for example, I've run Suricata in some locations and we thought of it as I guess a "low hanging fruit picker" for some stuff. Malware authors aren't any more immune to writing buggy stuff, having low quality code heavily made from Google copypaste, and so forth then any other software community. Not all users are running fully patched systems facing modern cutting edge malware either, in some settings you may have people connect running something ancient who click on every single "BROWSER XLR8TER DELUXXEE + FREE CAMS" extension ad they see. So in a few instances it's been a useful, low effort and automated way to notice somebody infected with something dumb and track it down right away. But there should be no illusions about it substituting for strong network and application security practices everywhere else on the LAN, including some level of isolation. Full BeyondCorp style Zero Trust might not yet be feasible for everyone but there are strong lessons there that can be applied, and at the least that it's very dangerous to blindly trust even a "secure network" just because it's behind a firewall. Which unfortunately is still a prevalent attitude, and IoT is making that even worse for more and more people/organizations. It's unfortunate there aren't more widely available, better and more automated/visual solutions that would make it easier for non-experts to make use of stuff like VLANs and 802.1x. Some things may always take more experience, but I think the pure tech exists to do better then many places are now in terms of network protection and it's more a matter of UX/accessibility. Also, it's not like it's always free. Even beyond false positives and such, there is a certain amount of hardware needed to run these things as connection speeds go up. When operating on 50 Mbps ADSL then sure, nearly anything can do it no problem, but push that up to 1-2 Gbps or more and at least right now that means significantly more chunky kit. In some places it won't even be a rounding error, but for small businesses (let alone individuals) spending that money should be weighed more carefully.