> If the user is tricked, then the loss is catastrophic, exposing potentially all of the user's data, perhaps silently/undetectably for considerable future time

> If the user is tricked, then the loss is catastrophic, exposing potentially all of the user's data, perhaps silently/undetectably for considerable future time. For offline users we also have malware detection and firewalls. Stopping outgoing connections can be be really effective, bjt of course: if one has doubts one probably shouldn't install.