This is absolutely true in practice, but there are degrees. Approximately 0 people are going to go full tinfoil hat and setup their own self-hosted FOSS solutio

This is absolutely true in practice, but there are degrees. Approximately 0 people are going to go full tinfoil hat and setup their own self-hosted FOSS solution, but we absolutely should care if a product like Zoom does something like, say, installs a local web server to bypass security controls on a user's browser which can potentially open up any number of devastating remote exploits that would be easy to exploit by any script-kiddy. The fact that most users don't care is more reason why product developers HAVE to care. I could just as easily say "only paranoid security people care if we hash their passwords in our database so why waste the CPU cycles?" And I would be right, the vast majority of users don't know anything about storing passwords securely but they absolutely care whether their passwords get pilfered by an attacker and used to compromise their account.