Agreed, though there's still something to be said about strong default settings. And there's a huge difference between something asking for a password than som

Agreed, though there's still something to be said about strong default settings. And there's a huge difference between something asking for a password than something installing something drive-by without any notification whatsoever. From a social engineering perspective, it's a lot harder to get someone to enter a password than it is to get them to simply click on something. Yes, there'd still be malware because of stupid users, but there'd be a lot less of it.