I suppose one could question what is an acceptable level of risk. Security is hard, effective security even harder. Threat actors are looking for any way in and

I suppose one could question what is an acceptable level of risk. Security is hard, effective security even harder. Threat actors are looking for any way in and when they attack a target, it's not just personal information that they are after. Compromising a device potentially means that they can access the target work place details too. Another thing to consider is culpability. If a device owner bricks their phone because the have downloaded malware through 3rd party store, who are they going to look too for support?