I wouldn't bet on every security researcher also being a security enthusiast and vice versa. Also it depends on your scope. Plus the attacks originated from con

I wouldn't bet on every security researcher also being a security enthusiast and vice versa. Also it depends on your scope. Plus the attacks originated from conversations mainly via Twitter and other social media and email. I am probably wrong, but even a security researcher wouldn't boot up a readonly OpenBSD live system with a cli-based browser just to access Twitter, as you are trying to imply. Also the article mentions compromising people with forged VS Studio projects relying on Powershell. To me this is pretty much "average people" software.